
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
Providing reliable and pluggable intelligent processing capabilities for building code assistant tools.
中文 | English
Sema Code Core is an event-driven AI coding assistant core engine that provides reliable and pluggable intelligent processing capabilities for building code assistant tools. It supports core capabilities such as multi-agent collaboration, Skill extension, and Plan mode task planning, and can be quickly integrated into various AI programming tools.
| Feature | Description |
|---|---|
| Natural Language Instructions | Directly drive programming tasks through natural language |
| Permission Control | Fine-grained permission management ensures safe and controllable operations |
| Subagent Management | Multi-agent collaboration with dynamic sub-agent scheduling based on task types |
| Skill Extension Mechanism | Plugin architecture to flexibly extend AI programming capabilities |
| Plan Mode Task Planning | Decomposition and execution planning of complex tasks |
| MCP Protocol Support | Built-in Model Context Protocol service to support tool extension |
| Multi-Model Support | Compatible with Anthropic, OpenAI SDK, and LLM APIs from major vendors |
IDE / Editor Plugin Development — Provides low-level AI capability encapsulation for editors, allowing developers to focus on UI interaction without self-developing complex large model scheduling and tool calling logic.
Enterprise Internal R&D Tools — Private deployment + permission control, adapting to enterprise-owned models and security specifications. Out-of-the-box toolchain avoids building AI programming infrastructure from scratch.
Vertical Domain Intelligent Workflow — Decomposes complex engineering tasks (migration, refactoring, documentation) into automated processes. Multi-agent collaborative execution replaces manual processing of repetitive coding work.
Academic Research & Agent Prototype Verification — Provides a lightweight Agent experimental environment for academic institutions and independent researchers, supporting flexible combinations of toolchains and agent strategies, allowing researchers to focus on algorithmic innovation.
Sema Code Extension is an intelligent programming plugin based on the Sema Code Core engine, supporting both the VSCode extension and JetBrains plugins (IntelliJ IDEA / PyCharm / GoLand / WebStorm / CLion, etc.).
SemaClaw is a general-purpose engineering harness for building personal AI agents.
A Skill web application based on Sema Code Core, integrating Agent Skill Browser / Creator / Playground demo.
mkdir my-app && cd my-app
npm init -y
npm install sema-core
Download quickstart.mjs to the my-app directory, then modify the following two configurations:
const core = new SemaCore({
workingDir: '/path/to/your/project', // Target repository path for the Agent to operate on
...
});
const modelConfig = {
apiKey: 'sk-your-api-key', // Replace with your API Key
...
};
For more model configuration options, see Model Management
node quickstart.mjs
Cross-Language Integration Reference README.md
# 1. Install dependencies
npm install
# 2. Build
npm run build
sema-core is released under the MIT License.
All production dependencies are pulled from the npm registry under permissive licenses (MIT / ISC / BSD / Apache-2.0 / BlueOak-1.0.0 / 0BSD); no copyleft (GPL / AGPL / LGPL) code is introduced. The full component list, license summary, and external service terms are tracked in THIRD_PARTY_NOTICES.md. Resolved versions are pinned via package-lock.json for reproducible installs and license traceability.
When calling third-party model or service APIs (Anthropic, OpenAI, OpenAI-compatible endpoints, MCP servers) through this library, the embedding application is responsible for complying with the corresponding provider's terms of service.
FAQs
Event-driven core library for Sema AI assistant
The npm package sema-core receives a total of 35 weekly downloads. As such, sema-core popularity was classified as not popular.
We found that sema-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.