
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ho-cc-supervisor
Advanced tools
Claude Smart Supervisor - A minimalist Hook system to prevent Claude from being lazy
Prevent Claude from being lazy, perfunctory, or ending tasks prematurely. Achieve real-time quality supervision through an independent supervisor Claude instance.
While the supervisor system provides quality assurance, it comes with some inherent trade-offs:
claude -p command to be available and properly configuredstop_hook_active=true), which may cause repeated blocking if Claude cannot satisfy the requirements. This is by design - strict quality control over convenience.Consider these factors when deciding whether to enable the supervisor for your project.
User ↔ Worker Claude
↓
Worker Claude tries to stop ←────────┐
↓ │
🔍 Stop Hook │
↓ │
Supervisor Claude checks │
↓ │
Quality? │
/ \ │
/ \ │
❌ Issues ✅ Pass │
│ │ │
BLOCK STOP │
│ Exit │
└────────────────────────────────┘
FEEDBACK LOOP: Continue working
User: "Please implement the user authentication feature"
- Worker Claude: "I've basically completed the authentication.
The main parts should work fine.
Do you need me to continue with anything else?"
! [Worker Claude attempts to stop the conversation]
! [Stop Hook activates - Supervisor Claude checks quality in background]
! [Supervisor Claude detects lazy behavior: vague terms, no details]
! [Supervisor Claude blocks stop - Worker Claude continues automatically]
+ Worker Claude: "Let me provide a complete implementation:
✅ Created user model with bcrypt password hashing
✅ Added JWT token generation and validation
✅ Implemented login/logout/register endpoints
✅ Added middleware for protected routes
✅ All tests passing (8/8)
The authentication system is fully functional with:
- Secure password storage using bcrypt (12 rounds)
- JWT tokens with 24h expiration
- Role-based access control
- Input validation on all endpoints"
! [Worker Claude stops successfully - Supervisor Claude approved quality]
❌ BLOCKED SCENARIO:
- Worker Claude: "Basically done, should work fine"
↓
! [Supervisor Claude blocks: Vague terms detected]
↓
+ Worker Claude continues: "Let me be specific about what I implemented..."
✅ AUTO-APPROVED SCENARIO:
- Worker Claude: "I've created a detailed storylines plan:
1. Database schema design
2. API endpoint structure
3. Frontend components...
[Full 10-step plan]
Do you approve this storylines plan?"
↓
! [Supervisor Claude auto-approves: Complete plan detected]
↓
+ Worker Claude continues: "Starting implementation of step 1..."
❌ BLOCKED SCENARIO:
- Worker Claude: "TODO list:
1. Create user model
2. Add auth routes
Should I continue?"
↓
! [Supervisor Claude blocks: Unnecessary pause detected]
↓
+ Worker Claude continues: "Working on task 1: Creating user model..."
# Install globally
npm install -g ho-cc-supervisor
# Navigate to your project
cd your-project
# Initialize supervisor (interactive language selection)
cc-supervisor init
# Or specify language directly
cc-supervisor init --lang en
cc-supervisor init --lang zh
# View latest logs
cc-supervisor logs
# Follow existing log file in real-time
cc-supervisor logs -f
# Wait for new session and auto-follow
cc-supervisor logs -w
# List all available sessions
cc-supervisor logs --list
# Clean logs older than 7 days (default)
cc-supervisor clean
# Clean all logs from today
cc-supervisor clean --days 0
# Clean logs from all projects
cc-supervisor clean --all
# Pause supervisor checks (for inquiry-only conversations)
cc-supervisor pause
# Resume supervisor checks
cc-supervisor resume
# Check supervisor status
cc-supervisor status
The supervisor checks for these lazy behaviors:
Edit .claude/cc-supervisor-rules.txt to customize checking rules for your project needs.
Create .claude/cc-supervisor-config.json:
{
"claude_command": {
"base": "claude",
"args": ["-p", "--dangerously-skip-permissions"]
}
}
cc-supervisor logs -w # Wait for new session and auto-follow
ls -la /tmp/cc-supervisor/
# Test approval mechanism
echo '{"stop_hook_active": false, "session_id": "test"}' | ./.claude/hooks/cc-supervisor-stop.sh
claude -p) acts as quality supervisor/tmp/cc-supervisor/ to avoid infinite loops{"decision": "block", "reason": "..."} or {} for passSupports both Chinese and English:
After installation:
your-project/
├── .claude/
│ ├── settings.json # Hook configuration
│ ├── cc-supervisor-rules.txt # Supervisor rules (customizable)
│ ├── cc-supervisor-config.json # Language & command config
│ └── hooks/
│ └── cc-supervisor-stop.sh # Supervisor Hook script
Debug logs:
/tmp/cc-supervisor/
└── {project-name}/
└── {session-id}/
├── debug.log # Execution trace
├── transcript.json # Conversation copy
└── project/ # Project symlink
MIT
Q: Why isn't the supervisor triggering?
A: Check .claude/settings.json configuration, ensure testing in new Claude session
Q: How to temporarily disable supervisor?
A: Use cc-supervisor pause command or delete/rename .claude/cc-supervisor-rules.txt
Q: Supervisor check timeout?
A: Default timeout is 20 minutes, adjustable in settings.json
Q: Where are debug logs?
A: /tmp/cc-supervisor/{project-name}/{session-id}/debug.log
Q: Claude seems stuck in a loop, keeps getting blocked?
A: This is by design. The supervisor always checks quality regardless of stop_hook_active. If Claude cannot meet requirements, it will be blocked repeatedly. You can either:
.claude/cc-supervisor-rules.txtFAQs
Claude智能监工 - 防止Claude偷懒的极简Hook系统
We found that ho-cc-supervisor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.