
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
framer-dalton
Advanced tools
CLI and agent skills for interacting with Framer projects via the Framer Server API.
CLI and agent skills for interacting with Framer projects via the Framer Server API.
Install or refresh the globally available skills:
npx framer-dalton@latest setup
That installs skills into ~/.agents/skills and ~/.claude/skills.
The CLI and the installed skills are meant to work together. There are three skills:
framer - the base skill that explains how to use the CLI and the API in general.framer-code-components - explains specific prompts for how to write code components and provides examples.framer-canvas-editing-project-<project id> - a dynamically-created skill that explains how to canvas edit and includes project context.npx framer-dalton@latest setup will install the base framer and framer-code-component skills.framer-code-components tells agents to always load framer first.framer tells agents to run npx framer-dalton@latest setup BEFORE loading the skill. This command will auto-update the cli and update the skill files.framer-canvas-editing-project-<project id> file. This file contains the latest agent system prompt from framer.getAgentSystemPrompt and the latest project context from framer.getAgentContext. Agents are told not to load this skill until after creating a session.Run make install-dev in this repo.
Run your agent in this directory and specifically load the framer-dev skill:
# Claude:
> /framer-dev
# Codex:
> $framer-dev
Use this when you change something in the Server API implementation.
make dev.make dev-tunnel.make install-dev in this repo.framer-dev-local skill:# Claude:
> /framer-dev-local
# Codex:
> $framer-dev-local
framer-api packageUse this when you change the server API interface itself, such as adding or changing API methods.
framer-api package available.npm install ....make generate-types
Later, to return to the procution skills:
make uninstall-dev
FAQs
CLI and agent skills for interacting with Framer projects via the Framer Server API.
We found that framer-dalton demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 66 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.