
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Local-first project planning, ticket updates, and Claude Code wiring.
npm install
npm run build
npm link # exposes `lc` globally
lc install # verify git, scaffold .letscode & ~/.letscode, add Claude hook
lc doctor
lc status
lc feature "Auth refresh" --readme
lc update "scaffolded session routes" --progress 15 --files src/auth.ts,src/session.ts
lc backup sync
Everything is stored per-repo in ./.letscode/ and mirrored backup in ~/.letscode/backups/<id-repo>/.letscode.
letscode (lc)
Local-first work journal + ticket glue for git repos. lc turns each branch into a lightweight “ticket,” logs quick updates/progress as you work, and mirrors everything to a home-directory backup. It also wires in Claude Code so your repo context is always at your fingertips.
What it does
Starts work with intent: lc feature "…" [--readme] / lc bug "…" creates a ticket folder and branch (feature/-), optional README scaffold.
Captures updates fast: lc update "what changed" [--progress N] [--files a,b] [--ask] appends a timestamped note tied to the current ticket branch (and, optionally, a % snapshot).
Keeps a clean local store: writes everything to ./.letscode/ (events, progress, ticket updates, todos later).
Backs up automatically: lc backup sync|watch|restore mirrors ./.letscode/ to ~/.letscode/backups//.letscode.
Claude Code ready: lc install adds a SessionStart hook so Claude automatically ingests .letscode/claude-context.json when you open it in the repo.
Why it’s useful
Zero cloud, zero friction: append-only NDJSON + JSON files you can diff, grep, and script.
Timeline you can replay: updates + progress snapshots create a living audit of scope and pace.
Cross-repo safety: your home backup mirrors the exact local data—portable and restorable.
AI in the loop: Claude sees your repo context by default; ask it for next steps, risks, or summaries.
What gets stored
Per repo (./.letscode/):
events.ndjson – everything notable (ticket.update, feature.create, progress.set, …)
progress.ndjson – { ts, percent, gist } snapshots
tickets//updates.ndjson – notes tied to that ticket/branch
claude-context.json – seed/summary file Claude can read (expand as you go)
Global backup (~/.letscode/backups//.letscode):
One-to-one mirror of the repo’s .letscode/ for easy restore (lc backup restore --force).
Typical workflow
lc install # verifies git, scaffolds .letscode, adds Claude hook
lc feature "Auth refresh" --readme
lc update "scaffolded session routes" --progress 15 --files src/auth.ts,src/session.ts
lc update --ask # prompts for message/%/files/tag
lc backup sync # or lc backup watch while you work
lc status
Common:
lc status (alias: lc s)lc feature "Title" --readme (alias: lc f)lc bug "Title" --readme (alias: lc b)lc update "msg" --progress 25 --files a,b (aliases: lc u, lc ua for prompt)lc todo add/list/done/rm (aliases: lc ta/tl/td/tr)lc context --stdout (alias: lc x)lc watch --interval 10m (alias: lc w)lc commit "msg" (alias: lc c)lc merge (alias: lc m) — interactive, can auto-commit dirty changeslc reflect [--interactive] (aliases: lc r, lc ri)lc metrics rollup|predict|view (aliases: lc mr/mp/mv)lc impact scan|set (aliases: lc is/it)lc baseline [--force]lc backup sync|watch|restore [--force]lc f "Auth refresh" --readme
lc w --interval 10m
lc m
lc baseline
What lc records to help you reason about work and pace:
Events (.letscode/events.ndjson)
Tickets (.letscode/tickets/<id>/)
lc fin)Context & baselines
Metrics (.letscode/metrics/)
Registry (.letscode/registry/)
AI-powered summaries
lc report --ai: concise narrative status report saved to .letscode/report-ai.mdlc retake: refresh scan/context/baseline and write project-summary.md (optionally inject into README between <!-- lc:summary:start --> and <!-- lc:summary:end -->)lc prompt start|voice|analyze: scaffold srcPlanning/.../PROMPT.md, run a Claude session, then generate ANALYSIS.md and store aiEstimateHoursFinish flow
lc fin records a final ticket note and per-ticket progress, runs interactive merge with acceptance check, marks the ticket closed, then runs a retake to refresh summaries.FAQs
Local-first project planning + Claude Code wiring
We found that letscode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.