
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
create-claude-starter
Advanced tools
Advanced Claude Code framework with 40+ skills, meta-commands, skill orchestration, workflow automation, and TOON format support
Production-ready Claude Code configuration with 40+ skills, TOON format support, and skill marketplace integration.
A .claude/ configuration directory for Claude Code that provides:
This is configuration, not code. No library, no framework, no runtime dependencies.
# Install to current project
npx create-claude-starter
# Install specific skills
npx create-claude-starter --skills stripe,supabase,expo
# Install with profile
npx create-claude-starter --profile web-saas
Or copy manually:
git clone https://github.com/raintree-technology/claude-starter.git
cp -r claude-starter/.claude your-project/.claude
Skills auto-activate based on context:
You: "How do I create a Stripe subscription?"
Claude: [Activates Stripe skill and provides implementation]
You: "Build a Whop membership backend"
Claude: [Activates Whop and provides code]
Skills work immediately with built-in knowledge. Optionally pull comprehensive API docs:
# Install docpull
brew install pipx && pipx install docpull
# Pull documentation
docpull https://docs.stripe.com -o .claude/skills/stripe/docs
docpull https://supabase.com/docs -o .claude/skills/supabase/docs
Compress JSON/data files by 30-60%:
/convert-to-toon api-response.json
/analyze-tokens data.json
| Category | Skills | Documentation |
|---|---|---|
| Payments | Stripe, Whop, Shopify | 3,490 files |
| Backend | Supabase | 2,616 files |
| Banking | Plaid (+ 4 sub-skills) | 659 files |
| Blockchain | Aptos, Shelby, Decibel | 246 files |
| Mobile | Expo (+ 3 sub-skills), iOS | 814 files |
| AI | Anthropic API, Claude Code (+ 5 sub-skills) | 400 files |
| Data | TOON Formatter | Tools + spec |
Total: 40 skills, 8,225 documentation files (pulled separately)
# Manage installation
npx claude-starter list # List available skills
npx claude-starter add expo ios # Add skills
npx claude-starter update # Update installed skills
# Manage documentation
npx claude-starter docs pull stripe # Pull specific docs
npx claude-starter docs pull # Pull all docs
npx claude-starter docs status # Check status
npx claude-starter docs update # Update stale docs
npx create-claude-starter --profile web-saas # stripe, supabase, expo
npx create-claude-starter --profile blockchain # aptos, shelby, decibel
npx create-claude-starter --profile minimal # toon-formatter only
.claude/
├── skills/ # 40 auto-activating skills
├── commands/ # 7 slash commands
├── hooks/ # 5 automation hooks (disabled by default)
├── utils/toon/ # TOON encoder/decoder (Zig binary + source)
└── settings.json # Configuration
<!-- .claude/skills/my-api/skill.md -->
# My Company API
Auto-activates when: user mentions "my-api"
## Endpoints
- POST /api/v1/users - Create user
- GET /api/v1/users/:id - Get user
See docs/creating-components.md for templates.
See SECURITY.md for vulnerability disclosure and security measures.
All third-party trademarks are property of their respective owners. See TRADEMARKS.md.
Not affiliated with or endorsed by Stripe, Anthropic, Supabase, Expo, Plaid, Shopify, or Whop.
MIT - See LICENSE
FAQs
Advanced Claude Code framework with 40+ skills, meta-commands, skill orchestration, workflow automation, and TOON format support
We found that create-claude-starter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.