
Research
/Security News
npm Package Uses Prompt Injection and Token Flooding to Disrupt AI Malware Scanners
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.
pspec (picospec) is the smallest specification toolkit for solo developers and AI agents
A minimalist Spec-Driven Development (SDD) toolkit for solo developers and AI agents.
pspec (picospec) is a lightweight alternative to heavy SDD frameworks. It focuses on clear intent, executable task breakdowns, explicit verification, and a finish line that includes tests and real-flow validation.
It is designed to work alongside Claude Code, Gemini CLI, Cursor, OpenCode, Antigravity, and Kilo Code.
/pspec.spec and /pspec.plan must cover failure modes, not only happy paths.Run pspec directly with npx so your generated agent commands always use the latest prompts.
npx pspec@latest
The workflow is: Initialize -> Spec -> Plan -> Audit -> Implement.
Run this in your project root:
npx pspec@latest
.pspec/specs/, .pspec/tasks/, and .pspec/CONTEXT.md..opencode/commands/pspec.plan.md or .cursor/rules/pspec.implement.mdc.You may need to restart your AI agent session after init so it detects the new slash commands.
Use /pspec.spec to draft a PRD.
/pspec.spec Add session-based authentication for the admin dashboard
.pspec/CONTEXT.md when present..pspec/specs/<epoch-ms>-<slug>.md.The PRD should cover:
The final PRD should use stable IDs:
AC-01, AC-02, ... for acceptance criteriaEC-01, EC-02, ... for edge cases and failure modesUse /pspec.plan on a PRD.
/pspec.plan .pspec/specs/1742451234567-auth.md
PROGRESS.md, the feature spec files, and the coverage map for parity..pspec/tasks/<epoch-ms>-<slug>/.Each feature-spec directory contains:
PROGRESS.md as the completion tracker and shared context file01-create-auth-types.mdFeature specs are outcome-based, not file-based. One feature spec can cover multiple production files, tests, scripts, and config changes when they belong to one coherent unit of work.
The planner must also include a coverage map so every AC-* and EC-* from the PRD is assigned to one or more feature specs.
Each feature spec should define these guardrail sections up front:
data-testid values to use in both code and testsPROGRESS.md carries shared context and task status:
---
spec: .pspec/specs/1742451234567-auth.md
stem: 1742451234567-auth
created: 2026-04-27T10:00:00Z
context:
key_files:
- src/auth/
- src/api/
patterns:
- Follow request handler structure from src/users/routes.ts
commands:
test: npm test
lint: npm run lint
build: npm run build
conventions:
naming: camelCase functions, PascalCase types
exports: named exports only
---
# Progress
## Status Keys
- `[ ]` not started
- `[>]` in progress
- `[x]` complete
- `[~]` blocked
## Coverage Map
- `AC-01` -> `01-model-and-service.md`
- `EC-01` -> `01-model-and-service.md`, `02-http-endpoints.md`
## Feature Specs
- [ ] `01-model-and-service.md` - Add auth domain model and service flow
- [ ] `02-http-endpoints.md` - Add login and logout endpoints
- [ ] `03-web-verification.md` - Add UI states, test IDs, and end-to-end verification
## Active Work
- Current: `None`
- Phase: `idle`
- Resume: `Start with the next [ ] feature spec in numeric order.`
## Notes
- Complete tasks in numeric order unless a dependency note says otherwise.
- Mark a feature spec `[>]` and update `## Active Work` before editing code so interrupted runs can resume cleanly.
- A task is done only when its definition of done passes.
Each feature spec file contains its own frontmatter and execution details:
---
id: 1
title: Add auth domain model and service flow
tag: CRITICAL
spec_ref:
- "AC-03"
- "EC-02"
depends_on: []
---
# Goal
Deliver the core login/logout domain logic and shared auth types.
## Requirement Coverage
- `AC-03` - Adds the core auth flow behavior
- `EC-02` - Covers invalid credentials and locked-account behavior
## Files
### Create
- `src/auth/service.ts` - Core authentication service
- `src/auth/service.test.ts` - Unit coverage for the service
### Modify
- `src/auth/types.ts` - Shared auth contracts
### Reference
- `src/users/service.ts` - Existing service structure
## Data Model
- `AuthSession` with session id, user id, created at, expires at
- `LoginInput` with email and password
## API Contracts
- Endpoint: `POST /api/auth/login`
- Request: `{ email: string, password: string }`
- Response: `{ user: { id: string, email: string }, sessionId: string }`
## UI States
- Not applicable
## User Interactions
- Not applicable
## Data Test IDs
- Not applicable
## Edge Cases
- Invalid password
- Unknown email
- Locked account
- Session store failure
## Approach
1. Add the auth service and shared types.
2. Implement success and failure paths.
3. Add unit tests for the base case and listed edge cases.
4. Hook the service into the verification artifact if needed.
## Verification
- Base case:
- Command: `npm test -- auth/service.test.ts`
- Expected: successful login path passes
- Unit tests:
- Command: `npm test -- auth/service.test.ts`
- Expected: base and failure-path assertions pass
- Edge cases:
- Command: `npm test -- auth/service.test.ts`
- Expected: invalid credentials, locked account, and store failure cases pass
- E2E:
- Type: `api-script`
- Path: `scripts/verify-auth-flow.sh`
- Command: `bash scripts/verify-auth-flow.sh`
- Expected: login and logout flow succeeds against the running app
## Definition Of Done
- Functional behavior is finished.
- Unit tests cover the base case and listed edge cases.
- Failure modes are implemented and verified.
- The end-to-end verification artifact runs successfully.
Every task must define and satisfy all of the following:
End-to-end verification artifact rules:
Use /pspec.audit when the PRD changed after planning, when feature spec files drift from PROGRESS.md, or before implementation to confirm the plan is still aligned.
/pspec.audit .pspec/tasks/1742451234567-auth/PROGRESS.md
PROGRESS.md and the linked PRD.[ ] when requirement coverage changed materially.PROGRESS.md and feature spec files.Use /pspec.implement with the feature-spec directory or PROGRESS.md path.
/pspec.implement .pspec/tasks/1742451234567-auth/PROGRESS.md
PROGRESS.md first.AC-* and EC-* in the coverage map is valid.PROGRESS.md and the real feature spec files match before starting work.PROGRESS.md as a resumable checkpoint and resumes any existing [>] feature spec before new work.## Active Work updated with the current feature spec, phase, and next resume step./pspec.implement again to continue remaining runnable feature specs.done means the final closeout audit passed and no [ ], [>], or [~] remains.partial means the current run completed at least one additional feature spec before an explicit blocker stopped it.blocked means the current run could not complete any additional feature spec because an explicit blocker stopped it.partial or blocked for a voluntary mid-run handoff.TRIVIAL tasks require 1 full review pass.CRITICAL tasks require 2 full review passes.The self-review must check:
TODO, FIXME, placeholder, or follow-up markers remain unless explicitly alloweddata-testid values still match the feature spec when applicableIf review finds issues, the agent fixes them, reruns verification, and reviews again before checking the task off in PROGRESS.md.
Truthfulness rules:
done while any [ ], [>], or [~] remains in PROGRESS.mdpartial or blocked for a voluntary mid-run handoffUse /pspec.debug for failures or regressions.
/pspec.debug [error log or description]
PROGRESS.md to keep the fix aligned.NPM_TOKEN repository secret with publish access to the npm package..github/workflows/auto-release.yml.package.json changes on the master branch, the workflow creates a GitHub Release and publishes to npm.latest; prereleases such as 1.2.3-beta.1 publish to the matching dist-tag such as beta.your-project/
├── .pspec/
│ ├── pspec.json
│ ├── CONTEXT.md
│ ├── specs/
│ │ └── 1742451234567-auth.md
│ └── tasks/
│ └── 1742451234567-auth/
│ ├── PROGRESS.md
│ ├── 01-model-and-service.md
│ ├── 02-http-endpoints.md
│ └── 03-e2e-verification.md
├── .opencode/
│ └── commands/
│ ├── pspec.spec.md
│ ├── pspec.plan.md
│ ├── pspec.audit.md
│ ├── pspec.implement.md
│ └── pspec.debug.md
├── .gemini/
│ └── commands/
│ ├── pspec.spec.toml
│ ├── pspec.plan.toml
│ ├── pspec.audit.toml
│ ├── pspec.implement.toml
│ └── pspec.debug.toml
├── .claude/
│ └── commands/
│ ├── pspec.spec.md
│ ├── pspec.plan.md
│ ├── pspec.audit.md
│ ├── pspec.implement.md
│ └── pspec.debug.md
├── .cursor/
│ ├── commands/
│ └── rules/
├── .agent/
│ ├── workflows/
│ └── skills/
├── .kilo/
│ └── commands/
├── src/
└── package.json
pspec now favors serial, complete execution over orchestration features.
/pspec.spec asks focused questions, collects answers, then completes the PRD draft in one pass once the answers are sufficient./pspec.plan asks focused questions first, then completes the feature-spec directory in one pass with PROGRESS.md, one file per feature, and a coverage map for every AC-* and EC-* requirement./pspec.audit audits and syncs the feature-spec directory against the PRD without changing product code./pspec.implement reads PROGRESS.md, audits the feature-spec registry and coverage map, executes one feature spec file at a time, verifies the base case and edge cases, runs unit tests and the end-to-end artifact, checks API/UI contract fidelity, checks every definition-of-done bullet, keeps going until every runnable feature spec is complete or the run is explicitly blocked, and only then marks completion./pspec.debug works through likely causes serially and keeps active task directories in sync.This keeps the workflow explicit and reviewable without adding orchestration-specific structures to your project.
See AGENTS.md for contributor-facing architecture notes.
FAQs
pspec (picospec) is the smallest specification toolkit for solo developers and AI agents
The npm package pspec receives a total of 23 weekly downloads. As such, pspec popularity was classified as not popular.
We found that pspec demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A new npm package tests AI malware scanners with prompt injection, safety-triggering comments, context flooding, and obfuscated JavaScript.

Product
Socket now detects supply chain risks in project manifests, starting with missing lockfiles that can make dependency installs non-reproducible.

Research
/Security News
The trojanized extensions use TinyGo-compiled WebAssembly and Solana transaction memos to resolve command-and-control infrastructure.