
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
internalcot
Advanced tools
internalcot asks a model to put its working notes in a visible function call before answering.
The notes are model-authored scratchpad text, not access to hidden reasoning tokens.
npm install --global internalcot
Set OPENAI_API_KEY before running the CLI. OPENAI_BASE_URL can point the OpenAI SDK at a compatible gateway.
internalcot "Solve this problem"
cat problem.md | internalcot
internalcot --model gpt-5.6-sol --effort none "Check this proof"
Scratchpad output goes to stderr; the final answer goes to stdout so it can be redirected or piped.
internalcot "Check this proof" >answer.md 2>scratchpad.txt
Run internalcot --help for all options.
The CLI owns the Responses API request. It sets native reasoning effort to none by default,
requires an internalcot function call on the first turn, displays that call's arguments, and
then returns the tool result so the model can produce its final answer.
This does not reveal private or hidden chain-of-thought. It elicits a separate, observable scratchpad whose usefulness and faithfulness should be evaluated independently.
npm install
npm run check
npm test
npm run build
npm link
The package is public and unscoped. Before the first release:
npm login
npm whoami
npm run prepublishOnly
npm pack --dry-run
npm publish
Check that internalcot is still available on npm immediately before publishing.
FAQs
Make agents show their full chain of thought with persistent, visible working notes.
The npm package internalcot receives a total of 26 weekly downloads. As such, internalcot popularity was classified as not popular.
We found that internalcot demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.