
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills. Node wrapper around the skillxp Go CLI.
Node wrapper around skillxp, a Go CLI that observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills: it installs a skill in a fresh fixture, invokes the harness headlessly, and reports what actually reached the model, with transcript evidence.
Installing this package delivers the real Go binary for your platform via an optional dependency (no install scripts).
Windows is temporarily unavailable on npm (a registry naming issue is
being worked out with npm support); use the
PyPI package or a
release binary
with SKILLXP_BINARY in the meantime.
npx skillxp harnesses
npx skillxp observe -harness claude-code -install ./my-skill \
-prompt "Activate the my-skill skill and follow its instructions." \
-activation -trace "PHRASE-IN-BODY-1234" -out out/
Identical to the Go CLI — see the project README for the full surface and the observation bundle layout.
The CLI writes its results to disk (observation.json, session.json,
archived transcripts) rather than printing a JSON envelope, so this
package carries no invocation API. Spawn the CLI yourself and read the
bundle; binaryPath() exposes the bundled binary:
const { binaryPath } = require("skillxp");
const { execFileSync } = require("node:child_process");
execFileSync(binaryPath(), ["observe", "-harness", "claude-code", ...]);
Set SKILLXP_BINARY to override which binary the wrapper invokes.
FAQs
Observes how agent harnesses (Antigravity CLI, Claude Code, Codex CLI) load and activate Agent Skills. Node wrapper around the skillxp Go CLI.
The npm package skillxp receives a total of 10 weekly downloads. As such, skillxp popularity was classified as not popular.
We found that skillxp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.