
Research
/Security News
Two Joyfill npm Beta Releases Compromised to Deliver DEV#POPPER Remote Access Trojan
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.
create-adsk
Advanced tools
Adopt the Agentic Development Starter Kit as a versioned profile (skills + Cursor wiring).
█████╗ ██████╗ ███████╗██╗ ██╗
██╔══██╗██╔══██╗██╔════╝██║ ██╔╝
███████║██║ ██║███████╗█████╔╝
██╔══██║██║ ██║╚════██║██╔═██╗
██║ ██║██████╔╝███████║██║ ██╗
╚═╝ ╚═╝╚═════╝ ╚══════╝╚═╝ ╚═╝
Adopt the Agentic Development Starter Kit (ADSK) as a versioned profile — first-party skills via the skills CLI plus optional Cursor commands/rules — without a skills marketplace UX.
A ready-to-adopt kit for agentic, spec-driven development — workflow skills, Cursor slash commands, and a versioned profile for your team.
| Tool | Owns |
|---|---|
npx skills | Install and update skill folders into .agents/skills/ |
npx create-adsk | Apply an ADSK profile (skills + Cursor + .adsk/config.json) |
Use npx skills to install skill folders. Use npx create-adsk when you want this kit’s workflow + Cursor adopted as a versioned profile in your repo.
# From an app repo (after npm publish):
npx create-adsk --profile delivery --yes
# From a kit checkout (until publish):
npx --yes /path/to/agentic-development-starter-kit/packages/create-adsk --profile delivery --yes
Profiles (core | delivery | maintainer | skills-only) are defined in the kit profiles.json. Product contract: docs/product/create-adsk.md.
npx create-adsk init --profile delivery --yes # default command
npx create-adsk update # from .adsk/config.json
npx create-adsk status # profile + drift (exit 1 if drift)
npx create-adsk --help # skills-style banner + command list
Flags: --yes / -y, --dry-run, --scope project|global, --force-rules, --with-optional-packs, --target <dir>.
# from kit root
./scripts/prepare-create-adsk-snapshot.sh
cd packages/create-adsk && npm install && npm test && npm run build
node dist/cli.js --help
Releases use npm Trusted Publishing from .github/workflows/publish-create-adsk.yml (OIDC + provenance). Day-to-day and bootstrap steps: docs/RELEASE.md.
FAQs
Adopt the Agentic Development Starter Kit as a versioned profile (skills + Cursor wiring).
The npm package create-adsk receives a total of 1,033 weekly downloads. As such, create-adsk popularity was classified as popular.
We found that create-adsk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Two Joyfill npm beta releases contain an import-time implant that uses blockchain transactions to retrieve a remote-access trojan.

Security News
Socket releases free Certified Patches for high-severity Nuxt vulnerabilities, including server-side remote code execution through server island props.

Security News
An open letter signed by 50 companies, from NVIDIA and Microsoft to Mistral and Hugging Face, urges Washington not to restrict open weight AI.