
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
git-worktree-toolbox
Advanced tools
MCP server for managing git worktrees with synchronized branches. Provides tools for creating isolated development environments, tracking changes, and managing collaborative workflows.
🌳 Git Worktree Toolbox is a MCP server and CLI for managing git worktrees.
Create isolated workspaces without the hassle of stashing changes and switching branches.
Ideal for AI-assisted development workflows requiring multiple features in parallel.
As a backup, use the gwtree command to run any of the mcp tools yourself.
list - List projects and their worktreesnew - Create a new worktree with a matching brancharchive - Archive worktrees and branchesgo - Open worktree folder in your editorchanges - Review changes and optionally commit and pushgrab - Pull in changes from a specific worktreepr - Generate a link to create a pull/merge requestprompt - Resume AI agent sessions or setup AI agent auto-prompt (Claude/Cursor)doctor - Fix worktree metadata issuesclean - Archive unused worktreesOnce the MCP server is added, here's how you might phrase requests to activate each tool:
Add the MCP Server to Cursor / Claude Desktop:
{
"mcpServers": {
"git-worktree-toolbox": {
"command": "npx",
"args": ["-y", "git-worktree-toolbox@latest"]
}
}
}
The gwtree CLI is also available after a global installation:
npm install -g git-worktree-toolbox
Run gwtree help to see the available tools and their flags.
# List all projects with worktrees
gwtree list
# Create a new worktree with a matching branch
gwtree new "Fix login bug and flow"
# Archive current worktree (with branch removal)
gwtree archive -r
# Open current worktree and branch in editor
gwtree go
# Show the changes from all associated worktrees
gwtree changes
# Pull in changes from a specific worktree
gwtree grab fix-login-bug-1242
# Commit and push changes in a specific worktree
gwtree changes fix-login-bug-1242 -c
# Generate a link to create a pull/merge request
gwtree pr
# Fix worktree metadata issues
gwtree doctor
# Archive unused worktrees
gwtree clean
# Setup AI agent auto-prompt plugin (Claude by default)
gwtree prompt setup
# Setup with Cursor Agent instead
gwtree prompt setup --cursor
# Resume AI agent session for a worktree
gwtree prompt <worktree-id>
# Show help with advanced flag usage examples
gwtree help
When using the CLI, an interactive session with either Claude CLI or Cursor Agent can be automatically spawned in the new workspace, ready to use.
# 1. Setup AI agent plugin (one-time)
gwtree prompt setup # Claude (default)
gwtree prompt setup --cursor # Cursor Agent
# 2. Create worktree - AI agent auto-launches
gwtree new "Add user authentication"
# → AI agent starts with task context
# → Session ID saved in worktree metadata
# 3. Resume AI agent session later
gwtree prompt user-authentication-123
# → Continue conversation with full history
gwtree prompt~/.gwtree/ai-agent.yaml to customize templatesSee src/plugins/claude-prompt/README.md and src/plugins/cursor-agent/ for more information.
Optionally, configure the worktrees folder and project directories using environment variables:
# Storage directory for worktrees
# Default: ~/.gwtree/worktrees
export BASE_WORKTREES_PATH=~/my-custom-worktrees
# Custom project directories for discovery (colon-separated)
# Default: ~/Projects, ~/Code, ~/Developer
export PROJECT_DIRECTORIES="$HOME/custom-projects:$HOME/work"
Add these to your shell profile (~/.zshrc, ~/.bashrc, etc.) to persist across sessions.
FAQs
MCP server for managing git worktrees with synchronized branches. Provides tools for creating isolated development environments, tracking changes, and managing collaborative workflows.
We found that git-worktree-toolbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.