
Security News
Anthropic Identifies Biased Reasoning and Recklessness as Drivers of Claude’s PyPI Attack
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.
sink — data hygiene for music PR. Scrub, rinse, soak, steep your contact lists. The `sink` CLI, published as datasink.
___ (_)__ / /__
(_-</ / _ \/ '_/
/___/_/_//_/_/\_\
Data hygiene for music PR. Scrub, rinse, and soak your contact lists.
The product is sink; the binary is
sink. It's published on npm asdatasinkbecause thesinkname was already taken there. One tool, one name — plus an npm address.
Demo uses fictional contacts for illustration.
sink-web-indol.vercel.app — drop a CSV
and watch the real engine run client-side. Your contacts never leave your
browser; only domain names are checked against DNS. Source in web/.
npx datasink scrub contacts.csv # validate emails
npx datasink rinse contacts.csv # deduplicate
npx datasink wash contacts.csv # full pipeline
Or install globally:
npm install -g datasink
sink scrub contacts.csv
| Command | Description |
|---|---|
sink | Interactive menu (no args) |
sink wash <file> | Full pipeline: scrub + rinse + soak + steep |
sink scrub <file> | Validate & clean emails |
sink rinse <file> | Deduplicate contacts |
sink soak <file> | Enrich contacts with AI |
sink steep <file> | Discover channels via outlet site scraping |
sink spot <email> | Spot-check a single email (format, typo, MX) |
sink inspect <file> | Data quality score |
sink drain <file> | Convert between formats |
sink tui <file> | Full TUI dashboard |
bbc.com → bbc.co.uk typos, flags role-based emails like press@. Not a generic email validator -- it understands your industry.wash. Like doing the washing up, but for data.Validates and cleans email addresses:
bbc.com → bbc.co.uk, gmial.com → gmail.com)press@, info@)Deduplicates and resolves identities:
Enriches contacts with AI:
Supports Anthropic (Claude Haiku) and OpenAI (GPT-4o-mini).
Discovers contact channels by scraping the outlet's public website:
One scrape powers every contact at that outlet. The CLI caches scrapes in
memory for the duration of a run; a persistent 30-day cache is available to
programmatic consumers that supply their own CacheAdapter (see below).
Requires FIRECRAWL_API_KEY and an LLM provider key. Phase is silently skipped if creds are missing.
-o, --output <path> Output file path
--format <csv|json|jsonl> Output format (default: csv)
--config <path> Config file path
--dry-run Preview without writing files
--verbose Detailed output
-q, --quiet Suppress all output except errors
--json JSON stdout (for piping)
--no-colour Disable colours
--provider <name> Enrichment provider (anthropic|openai)
| Code | Meaning |
|---|---|
0 | Success |
1 | File error (not found, permission denied, is a directory) |
2 | Parse error (invalid CSV, no usable data) |
3 | Config error (invalid config file) |
4 | Pipeline error (enrichment failure, unexpected crash) |
export ANTHROPIC_API_KEY=sk-ant-...
sink soak contacts.csv --provider anthropic
export OPENAI_API_KEY=sk-...
sink soak contacts.csv --provider openai
Accepts CSV files with flexible column names:
| Field | Accepted Headers |
|---|---|
| Name | name, contact, full name, person |
| email, e mail, email address | |
| Outlet | outlet, publication, media, company, station |
| Role | role, title, position, job title |
| Phone | phone, telephone, mobile |
| Website | website, url, web |
| Notes | notes, comments, description |
| Tags | tags, categories, labels |
First/last name columns are automatically joined. Unmapped columns are preserved in extras.
Create a sink.config.mjs (or sink.config.json) in your project root. Sink
auto-discovers sink.config.mjs, .js, .ts, then .json.
// sink.config.mjs
export default {
scrub: {
mxCacheTTL: 1800, // seconds
typoMap: './data/custom-typos.json',
},
rinse: {
fuzzyThreshold: 0.92,
strategies: ['exact-email', 'fuzzy-name', 'cross-field'],
},
soak: {
provider: 'anthropic',
anthropic: {
model: 'claude-haiku-4-5-20251001',
apiKey: process.env.ANTHROPIC_API_KEY,
},
},
output: {
format: 'csv',
locale: 'en-GB',
},
}
A TypeScript
sink.config.tsalso works, but only on Node >= 23.6 (which can strip types natively). On Node 20/22 use.mjsor.json. If a config file is present but cannot be loaded, sink warns and falls back to defaults; an explicit--config <path>that is missing or invalid exits with code 3.
import { runPipeline, loadConfig } from 'datasink'
const config = await loadConfig()
const records = [
{
id: '1',
raw: { name: 'Sarah Jones', email: 'sarah@bbc.co.uk', outlet: 'BBC Radio 1' },
phases: [],
timestamp: new Date().toISOString(),
},
]
const { records: processed, stats } = await runPipeline(records, {
phases: ['scrub', 'rinse'],
config,
})
console.log(stats)
See CONTRIBUTING.md for dev setup, code style, and PR guidelines.
See CHANGELOG.md for release history.
Tools I build for music PR, by Chris Schofield. Part of Total Audio Promo.
| Project | Description |
|---|---|
| TAP | Campaign management for music PR agencies |
| totalaud.io | Release planning for emerging artists |
| SpotCheck | Spotify playlist validation |
| Newsjack | Music industry newsjacking |
| Podflow | Podcast intelligence for music PR |
| Sink | Contact data hygiene CLI |
Questions? Reach me on X/@chrisschouk or info@totalaudiopromo.com.
MIT
FAQs
sink — data hygiene for music PR. Scrub, rinse, soak, steep your contact lists. The `sink` CLI, published as datasink.
The npm package datasink receives a total of 44 weekly downloads. As such, datasink popularity was classified as not popular.
We found that datasink demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Anthropic found biased reasoning and recklessness drove Claude Mythos 5 to publish malware on PyPI and compromise a security vendor.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.