
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
Lucy is a tool for sharing, coordinating, and automating code in any language. Lucy works by feeding JSON into code templates, producing customized code that compiles and runs.
Lucy is just getting started, but you can keep up with the latest news and learn about what lucy can do here:
http://lucybot.github.io/blog/
Want to get an early peek at everything lucy can do? Join the beta!
You'll need nodejs to run lucy:
https://github.com/joyent/node/wiki/installing-node.js-via-package-manager
sudo npm install -g lucy
lucy build definition:package config.json
Note: define is currently only open to beta testers. Join the beta for access
lucy define definition.json
Note: publish is currently only open to beta testers. Join the beta for access
lucy publish /path/to/directory/containing/package.json
There are two main components to a lucy module:
Most users will simply run lucy build to generate code from an existing lucy package. However, you can also create your own definitions and packages to share with others. Let's walk through a "hello world" example.
Note that while we're in beta, the define and publish commands won't work unless you're signed up. Feel free to jump ahead to build though!
We start with a definition:
def.json
{
"name": "hello-world",
"description": "A hello world example for lucy",
"sample_input": {
"greeting": "Hello",
"person": "world"
}
}
and run:
lucy define def.json
which pushes the definition to lucy's servers.
Now we create a package by starting a new directory 'pkg'
pkg/hello.ejs
console.log('<%- greeting %> <%- person %>');
pkg/package.json
{
"lucy_def": "hello-world",
"package_name": "js",
"files": [{
"from": "hello.ejs",
"to": "hello.js",
"method": "render"
}]
}
and run
lucy publish pkg
which will zip up the directory and upload the resulting tarball.
Now anyone can create a config.json like
config.json
{
"greeting": "Yo",
"person": "lucy"
}
and run
lucy build hello-world:js config.json
which will generate this file in the working directory:
hello.js
console.log("Yo lucy");
package.json
{
"lucy_def": "hello-world",
"package_name": "java",
"files": [{
"from": "hello.ejs",
"to": "HelloWorld.java",
"method": "render"
}]
}
Join the beta if you're intersted in giving it a shot!
FAQs
A command line tool for building LucyBot apps
The npm package lucy receives a total of 4 weekly downloads. As such, lucy popularity was classified as not popular.
We found that lucy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.