
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
import fs from 'fs-extra'; import path from 'path';
const tierDescriptions = { s: 'Fast Lane (Tier S) - minimal pipeline for bugfixes and small changes', m: 'Standard (Tier M) - 5-phase pipeline for feature blocks', l: 'Full (Tier L) - complete governance pipeline for complex, long-running projects', };
export async function generateReadme(config, targetDir) { const tier = (config.tier || 's').toLowerCase(); const tierDesc = tierDescriptions[tier] || '';
const content = `# ${config.projectName}
${config.description}
```bash ${config.installCommand || 'npm install'} ${config.devCommand || 'npm run dev'} ```
```bash ${config.testCommand || 'npm test'} ${config.typeCheckCommand ? config.typeCheckCommand + ' # type check' : ''} ```
This project uses Claude Code with a governance scaffold provided by tierward.
Pipeline: ${tierDesc}
Key files:
Every AI-assisted commit is tagged via `attribution.commit` in `.claude/settings.json` and should be reviewed by a human before merging to shared branches.
| Control | How it works |
|---|---|
| Test gate | Claude cannot complete a task until `${config.testCommand |
| Audit log | Every tool use is logged to `~/.claude/audit/` |
| Secret scanning | Pre-commit hook blocks accidental credential commits |
| CODEOWNERS | `.claude/` directory requires tech lead review on all PRs |
See `.github/PULL_REQUEST_TEMPLATE.md` for the PR checklist. All PRs that include AI-generated code must complete the AI review checklist. `;
await fs.writeFile(path.join(targetDir, 'README.md'), content); }
FAQs
Scaffold for legible, reviewable AI-assisted development
The npm package tierward receives a total of 34 weekly downloads. As such, tierward popularity was classified as not popular.
We found that tierward demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.