
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
code-graph-llm
Advanced tools
A language-agnostic, ultra-compact codebase mapper and agent memory system designed specifically for LLM agents. It optimizes context and token usage while enabling agents to learn from their own mistakes across sessions.
code-graph init.llm-agent-project-learnings.md.Code-Graph transforms your codebase into an agent-friendly environment using five core skills:
generate)imports, requires, inheritance).code-graph generate. This creates llm-code-graph.md, which agents use as their "Source of Truth" for navigation.reflect)llm-agent-project-learnings.md.code-graph reflect <CATEGORY> "The lesson learned".install-skills)code-graph <platform> install.install-hook)code-graph install-hook.watch)code-graph watch.To get the most out of Code-Graph, force your agent to follow this Strict Protocol (defined in llm-agent-rules.md):
llm-agent-project-learnings.md to check for existing pitfalls and llm-code-graph.md to locate the relevant "God Nodes" (core logic).code-graph reflect.code-graph generate to update the map for the next agent.After generating a graph, you can automatically configure your favorite LLM agent to use it by running the matching install command.
| Platform | Command |
|---|---|
| Claude Code | code-graph claude install |
| Cursor | code-graph cursor install |
| Gemini CLI | code-graph gemini install |
| Codex | code-graph codex install |
| OpenCode | code-graph opencode install |
| GitHub Copilot CLI | code-graph copilot install |
| VS Code Copilot Chat | code-graph vscode install |
| Aider | code-graph aider install |
| OpenClaw | code-graph openclaw install |
| Factory Droid | code-graph droid install |
| Trae | code-graph trae install |
| Hermes | code-graph hermes install |
| Kiro IDE/CLI | code-graph kiro install |
| Google Antigravity | code-graph antigravity install |
CLAUDE.md, .cursor/rules/, AGENTS.md) telling the agent to read llm-code-graph.md before answering architecture questions.Uninstall by replacing install with uninstall (e.g., code-graph claude uninstall).
| Platform | Action Taken | Directory / Files |
|---|---|---|
| Claude Code | Adds instructions to CLAUDE.md and installs a preToolUse hook for glob and grep. | .claude/settings.json |
| Cursor | Writes a global rule with alwaysApply: true. | .cursor/rules/code-graph.mdc |
| Gemini CLI | Copies skill globally and adds a beforeTool hook for read_file. | ~/.gemini/skills/code-graph/SKILL.md, .gemini/settings.json, GEMINI.md |
| Codex | Updates AGENTS.md and installs a preToolUse hook for bash. | .codex/hooks.json |
| OpenCode | Registers a plugin that fires before bash tool calls. | .opencode/plugins/code-graph.js, opencode.json, AGENTS.md |
| GitHub Copilot CLI | Copies the Code-Graph skill to the global skill directory. | ~/.copilot/skills/code-graph/SKILL.md |
| VS Code Copilot | Writes session-persistent instructions. | .github/copilot-instructions.md |
| Aider / Trae / etc. | Updates AGENTS.md and copies skill to global platform directory. | ~/.<platform>/skills/code-graph/SKILL.md, AGENTS.md |
| Kiro IDE/CLI | Writes global skill and steering file for automatic inclusion. | .kiro/skills/code-graph/SKILL.md, .kiro/steering/code-graph.md |
| Antigravity | Writes always-on rules and registers a slash command workflow. | .agent/rules/code-graph.md, .agent/workflows/code-graph.md |
CLAUDE.md, AGENTS.md, GEMINI.md, etc.) automatically. These files tell the agent: "Before searching files, read llm-code-graph.md."grep), the hook intercepts the call and injects a reminder: "Knowledge graph exists. Read llm-code-graph.md first." This forces the agent to use the graph for navigation instead of brute-force searching./code-graph as a command to manually invoke or refresh the graph context.Instruct your agent to follow the STRICT AGENT PROTOCOL in llm-agent-rules.md. This ensures the agent:
llm-agent-project-learnings.md before starting any task.llm-code-graph.md) after structural changes.The llm-code-graph.md file provides a high-level map and structural graph for relational reasoning:
Example Map Entry:
- [CORE] src/auth.js (↑3 ↓5) [TODO: Add JWT rotation] | desc: Handles user authentication.
- syms: [login [ (username, password) ], validateToken [ (token: string) ]]
## GRAPH EDGES
[src/auth.js] -> [imports] -> [jwt-library]
[AdminUser] -> [inherits] -> [BaseUser]
"Before acting, read
llm-code-graph.md. Follow the protocol inllm-agent-rules.md. If you encounter a bug or an environment quirk, use thecode-graph reflecttool to record the lesson inllm-agent-project-learnings.md."
Maximize efficiency by pointing your agent directly to the llm-code-graph.md and llm-agent-rules.md files.
Add this to your .clinerules file:
Before starting any task:
1. Read `llm-code-graph.md` for project structure.
2. Read `llm-agent-rules.md` for operational protocol.
3. Read `llm-agent-project-learnings.md` for past lessons.
4. **MANDATORY:** After any fix or learning event, you MUST update `llm-agent-project-learnings.md` using `code-graph reflect`.
Add to .cursorrules or .windsurfrules:
Always reference `llm-code-graph.md` before editing. You are REQUIRED to follow the "Reflection Cycle" in `llm-agent-rules.md`. If a task involves a non-obvious fix or an environment quirk, you MUST record it in `llm-agent-project-learnings.md` immediately.
Add to .github/copilot-instructions.md:
When answering questions about this codebase, prioritize the mapping data in `llm-code-graph.md`. You MUST suggest or perform a reflection entry for `llm-agent-project-learnings.md` after every bug fix or identified pitfall.
Create a GEMINI.md file (if not already using llm-agent-rules.md):
- Always read `llm-code-graph.md` as the primary source of truth.
- **CRITICAL:** Use `run_shell_command` to execute `code-graph reflect` after any bug fix or discovered quirk. Memory persistence is a mandatory part of every task completion.
In your project instructions or session startup:
"Read
llm-code-graph.mdfor a high-level overview. You are FORCED to record any project-specific quirk or non-obvious lesson usingcode-graph reflect <CAT> <LESSON>before finishing a task."
Add to your project prompt or prompts.md:
"Use
llm-code-graph.mdto navigate. Strictly adhere to the reflection cycle inllm-agent-rules.md. You MUST persist project memory by updatingllm-agent-project-learnings.mdon every failure or learned moment."
For any other agent, add this to your system instructions:
"This project uses
code-graph-llmfor context management. Always consultllm-code-graph.md. You ARE REQUIRED to persist new knowledge about the environment or logic using thecode-graph reflecttool. Failure to update memory is a failure of the task."
.gitignore.imports, requires, extends, and implements.llm-code-graph.md file with a dedicated ## GRAPH EDGES section.FAQs
Compact, language-agnostic codebase mapper for LLM token efficiency.
The npm package code-graph-llm receives a total of 130 weekly downloads. As such, code-graph-llm popularity was classified as not popular.
We found that code-graph-llm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.