
Research
6 Malicious Packagist Themes Ship Trojanized jQuery and FUNNULL Redirect Payloads
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.
This repository contains skills and extensions that I use across projects. Note that I often fine-tune these for specific repos, so some items may need small adjustments before reuse.
It is released on npm as mitsupi for use with the Pi package loader.
All skills live in the skills folder:
/anachb - Query Austrian public transport (VOR AnachB) for departures, routes, and disruptions./apple-mail - Search/read Apple Mail local storage and extract attachments./commit - Create git commits using concise Conventional Commits-style subjects./frontend-design - Design and implement distinctive frontend interfaces./ghidra - Reverse engineer binaries using Ghidra's headless analyzer./github - Interact with GitHub using the gh CLI (issues, PRs, runs, APIs)./google-workspace - Access Google Workspace APIs via local helper scripts./librarian - Cache and refresh remote git repositories in ~/.cache/checkouts./mermaid - Create and validate Mermaid diagrams with Mermaid CLI tooling./native-web-search - Trigger native web search with concise summaries and source URLs./oebb-scotty - Plan Austrian rail journeys via ÖBB Scotty API./openscad - Create/render OpenSCAD models and export STL files./pi-share - Load and parse session transcripts from shittycodingagent.ai/buildwithpi URLs./sentry - Fetch and analyze Sentry issues, events, transactions, and logs./summarize - Convert files/URLs to Markdown via uvx markitdown and summarize./tmux - Drive tmux sessions via keystrokes and pane output scraping./update-changelog - Update changelogs with notable user-facing changes./uv - Use uv for Python dependency management and script execution./web-browser - Browser automation via Chrome/Chromium CDP.Custom extensions for Pi Coding Agent are in pi-extensions:
answer.ts - Interactive TUI for answering questions one by one.context.ts - Context breakdown (extensions, skills, AGENTS.md/CLAUDE.md) + token usage, including loaded-skill highlighting.control.ts - Session control helpers (list controllable sessions, etc.).files.ts - Unified file browser with git status + session references and reveal/open/edit/diff actions.go-to-bed.ts - Late-night safety guard with explicit confirmation after midnight.loop.ts - Prompt loop for rapid iterative coding with optional auto-continue.notify.ts - Native desktop notifications when the agent finishes.prompt-editor.ts - In-editor prompt mode selector with persistence, history, config, and shortcuts.review.ts - Code review command (working tree, PR-style diff, commits, custom instructions, optional fix loop).session-breakdown.ts - TUI for 7/30/90-day session and cost analysis with usage graph.todos.ts - Todo manager extension with file-backed storage and TUI.uv.ts - Helpers for uv-based Python workflows.whimsical.ts - Replaces the default thinking message with random whimsical phrases.Custom themes are in pi-themes:
nightowl.json - Night Owl-inspired theme.These command files need customization before use. They live in plumbing-commands:
/make-release - Automates repository release with version management.Command wrappers live in intercepted-commands:
FAQs
Armin's pi coding agent commands, skills, extensions, and themes
The npm package mitsupi receives a total of 59 weekly downloads. As such, mitsupi popularity was classified as not popular.
We found that mitsupi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.

Security News
The GCVE initiative operated by CIRCL has officially opened its publishing ecosystem, letting organizations issue and share vulnerability identifiers without routing through a central authority.

Security News
The project is retiring its odd/even release model in favor of a simpler annual cadence where every major version becomes LTS.