
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Inspired by the SCUD short-range ballistic missile system—lightweight, flexible, and powerful. Like its namesake, SCUD can be deployed quickly in a variety of contexts, delivering results with minimal overhead.
A fast, AI-powered task management system. Parse PRDs into tasks, track dependencies, and visualize parallel execution waves.
Using pnpm (recommended):
pnpm add -g scud-task
cd your-project
scud init
Using npm:
npm install -g scud-task
cd your-project
scud init
# Create tasks from a PRD or feature doc
scud parse docs/feature.md --tag my-feature
# View tasks and dependencies
scud list --tag my-feature
scud waves --tag my-feature # Show parallel execution plan
# Find and work on next ready task
scud next --tag my-feature
scud set-status 1 in-progress
# When done, mark complete
scud set-status 1 done
# Visualize in browser
scud view
Quick reference: docs/reference/QUICK_REFERENCE.md Orchestrator pattern: docs/orchestrator.md
Tasks are stored in SCG (SCUD Graph) format—a token-efficient, human-readable text format that achieves ~75% token reduction compared to JSON. SCG explicitly represents the task dependency graph with sections for nodes, edges, and metadata. Inspired in part by Nikolai Mushegian's JAMS spec (GitHub).
@nodes
auth:1 | Design auth system | X | 13 | H
auth:1.1 | Implement JWT | D | 5 | H
@edges
auth:1.1 -> auth:1
Full spec: docs/reference/SCG_FORMAT_SPEC.md
Tasks become ready when their dependencies complete. No manual phase management required.
Task 1 ──┐
├──> Task 3 ──> Task 5
Task 2 ──┘ │
└──> Task 4
Group related tasks together (e.g., auth-system, payment-flow). Each tag has its own task graph.
Use orchestrator patterns to spawn multiple Claude Code agents in parallel, each working on a ready task. See docs/orchestrator.md.
scud wavesscud next finds ready tasksscud view opens browser dashboardscud claim/release prevents conflictsscud whois tracks active workGetting Started:
Patterns:
Development:
scud init # Initialize SCUD in current directory
scud warmup # Quick session orientation
scud tags # List all tags
scud tags <tag> # Set active tag
scud list [--tag <tag>] # List tasks
scud show <id> # Show task details
scud next [--tag <tag>] # Find next ready task
scud set-status <id> <status> # Update task status
scud stats [--tag <tag>] # Show statistics
scud waves [--tag <tag>] # Show parallel execution waves
scud view # Open task viewer in browser
scud mermaid [--tag <tag>] # Generate Mermaid diagram
scud parse <file> --tag <tag> # Parse PRD/doc into tasks
scud parse <file> --tag <tag> --no-guidance # Parse without project guidance
scud analyze-complexity # Analyze task complexity
scud expand --all # Break down complex tasks
scud expand --all --no-guidance # Expand without project guidance
Default model: grok-code-fast-1. Configure with scud config set-provider <provider> --model <model>.
Project guidance files in .scud/guidance/*.md are automatically included in AI prompts.
scud assign <id> <name> # Assign task to a developer
scud who-is [--tag <tag>] # See who's working on what
scud next-batch [--limit 5] # Get multiple ready tasks
scud doctor [--tag <tag>] # Diagnose stuck task states
scud log <id> "message" # Add log entry to task
scud log-show <id> # Show task log entries
scud commit [-m "msg"] # Git commit with task context
scud clean [--tag <tag>] # Clear tasks (with confirmation)
# 1. Initialize
scud init
# 2. Create tasks from PRD
scud parse docs/feature.md --tag auth-system
# Creates tasks with dependencies
# 3. View execution plan
scud waves --tag auth-system
# Shows which tasks can run in parallel
# 4. Work on next ready task
scud next --tag auth-system
# Returns: Task 1 is ready
scud set-status 1 in-progress
# ... do the work ...
scud set-status 1 done
# 5. Track progress
scud stats --tag auth-system
# Shows progress: 8/10 complete
# 6. Visualize
scud view
# Opens task viewer in browser
See docs/orchestrator.md for parallel execution patterns.
DAG-Driven:
Fast & Simple:
Visual:
Orchestrator-Ready:
export XAI_API_KEY=xai-...
Alternative providers: Anthropic (ANTHROPIC_API_KEY), OpenAI (OPENAI_API_KEY), OpenRouter (OPENROUTER_API_KEY). Configure with scud config.
.scud/
├── tasks/tasks.scg # All tasks in SCG format
├── config.toml # Provider/model settings
├── active-tag # Currently active tag
├── current-task # Active task ID (for commits)
├── guidance/ # Project guidance for AI prompts
│ └── *.md # Markdown files auto-loaded
└── logs/ # Task log entries
You can provide project-specific context that will be automatically included in AI prompts. Create markdown files in .scud/guidance/:
# Example: Add coding standards
echo "# Coding Standards
- Use TypeScript strict mode
- All functions must have JSDoc comments
- Maximum function length: 50 lines" > .scud/guidance/coding-standards.md
# Example: Add architecture notes
echo "# Architecture
- Frontend: React with hooks
- Backend: Express.js
- Database: PostgreSQL" > .scud/guidance/architecture.md
All .md files in this folder are automatically loaded when running scud parse or scud expand. Use --no-guidance to skip loading guidance.
# Build Rust CLI
cd scud-cli
cargo build --release
# The binary will be at:
# scud-cli/target/release/scud
Issues and PRs welcome at github.com/pyrex41/scud
MIT
Happy building!
FAQs
SCUD Task Manager - Fast, AI-powered task management for building software
We found that scud-task demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.