
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Planr is a local-first planning and execution coordination tool for coding agents. It combines reviewable Markdown plans with a dependency-aware work map so Codex, Claude Code, Cursor, generic MCP clients, and human operators can drive the same work safely — from idea to verified completion.
idea -> product plan -> build plan -> map -> pick -> log -> review/evidence -> close

Flat todo lists break down the moment real work has structure. Planr models work as a dependency graph because that is what work actually is:
ready only when its blockers are closed; planr pick returns work that is actually startable.planr recover sweep).Three layers make that work: Plans (reviewable Markdown packages), the Map (live dependency graph with picks, reviews, logs), and Agent loops (skills, CLI, and MCP workflows for every major coding agent). Full model: Task Graph Model and Operating Model.
Planr now ships a verified preset system for composing a provider-neutral usage policy with a host binding, previewing every repository-local change, and applying the result only after confirmation:
planr agents preset list
planr agents preset apply balanced --binding codex-openai --preview
planr agents preset apply balanced --binding codex-openai --confirm
The built-in catalog includes four policies, five host bindings, and 20 declared safe pairs. Reproducible evaluation, signed registry verification, and the public Planr Preset Catalog keep recommendation evidence inspectable without making the registry a runtime dependency. Full guides: Preset Composition · Preset Evaluation · Preset Registry.
planr install codex|claude|cursor now wires Planr into the host's native hook system by default — every new session (including post-compaction restarts) gets one compact state block injected automatically:
## planr state
project: Hookboard | map: 5/5 settled | 0 ready, 0 picked, 0 in_review
goal contract: DONE when every in-scope map item is closed with log evidence, ...
routing: registry active (3 profiles; pick packets carry model routing)
next: planr plan audit pln-fc584c28 --json
planr prime — the state block behind the hooks: project, map counts, held items with log status, goal contract, and the next command. Silent in repos without a Planr database.--no-hooks opts out.Full guide: Hooks · Release notes.
Declare once which model handles which work — every task then carries its own routing, and your agents delegate automatically:
# .planr/agents.toml (write it with `planr agents init`)
[profiles.frontender]
client = "cursor"
model = "opus"
skill = "frontend-design"
[[routes]]
match = { work_type = "frontend" }
profile = "frontender"
fallbacks = ["driver"]
planr pick --json hands the worker its profile, model, and paired skill; planr pick --peek lets dispatching drivers read it without taking the lease.planr install codex|claude|cursor writes the subagent role files with model pins from the registry, in each host's exact vocabulary.planr trace item shows deviations as advisory markers.frontend, backend, ...) declared right in the plan's task list (### TASK-001 (backend): ...), plus per-item pins via planr item route.Routing is advisory by design: Planr never dispatches models and never blocks a pick — hosts stay the authority. Full guide: Model Routing · replayable walkthrough: Worked Example: Web App · Release notes.
brew install instructa/tap/planr
Or via npm (ships platform-native binaries, no toolchain needed):
npm install -g planr
Or with the release installer:
curl -fsSL https://raw.githubusercontent.com/instructa/planr/main/scripts/install.sh | sh
Then initialize a project (also provisions the worker/reviewer subagent roles for your client):
planr project init "My Product" --client all
Manual downloads, from-source builds, and client wiring details: Install Guide.
The plugin under plugins/planr carries the nine Planr skills plus the planr-worker and planr-reviewer subagent roles. The planr CLI (above) is required separately.
codex plugin marketplace add instructa/planr
codex plugin add planr@planr
Inside a Claude Code session:
/plugin marketplace add instructa/planr
/plugin install planr@planr
Restart Claude Code afterwards. Skills are namespaced (/planr:planr, /planr:planr-loop), and the plugin registers the planr-worker and planr-reviewer subagents automatically.
One command installs everything the plugin would carry:
planr install cursor # writes .cursor/mcp.json, .cursor/agents/, and .cursor/skills/
planr install cursor --no-mcp # skills and subagents only, no MCP config
The dry-run also prints a one-click cursor:// deeplink for user-level MCP install. Marketplace listing is pending review. Multitasking with Cursor subagents: Cursor guide.
No plugin yet. Use Planr as an MCP server and paste the CLI prompt into your agent instructions:
planr mcp # stdio MCP server
planr prompt cli
Two skills drive everything. $planr routes any request to the right stage skill from live map state; $planr-loop drives one feature through work, live verification, and independent review until the map is clean.
Start a new product from an idea:
Use $planr.
Create a production-ready Habit Tracker web app plan. Create the product plan,
split an MVP build plan, check it, then build the Planr map. Do not implement yet.
Ship one feature autonomously until verified:
Use $planr-loop.
Goal: ship the weekly overview feature. DONE when every in-scope map item is closed
with log evidence, all reviews are closed complete, and a live verification log shows
the feature working in the browser. Iteration budget: 10.
Mid-project work (a new feature, refactor, or fix on an existing project) works the same — it gets its own feature-scoped plan and extends the existing map. Both journeys with example prompts: Two Journeys. Watch progress anytime with planr map show.
MIT. See LICENSE.md.
FAQs
Local-first planning and execution coordination for coding agents.
The npm package planr receives a total of 674 weekly downloads. As such, planr popularity was classified as not popular.
We found that planr demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.