
Research
/Security News
CanisterWorm: npm Publisher Compromise Deploys Backdoor Across 29+ Packages
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.
toh-framework
Advanced tools
"Type Once, Have it all!" - AI-Orchestration Driven Development
🌐 Official Website: tohframework.dev
| IDE | Status | Notes |
|---|---|---|
| 🧠 Claude Code | ✅ Full Support | Native Sub-Agents, Slash commands |
| 📝 Cursor | ✅ Full Support | @ file references |
| 🌌 Google Antigravity | ✅ Full Support | Gemini integration |
| 💎 Gemini CLI | ✅ Full Support | Context files auto-loaded |
| 🤖 Codex CLI | ✅ Supported | OpenAI agents |
Toh = Type Once, Have it all!
We believe Solo Developers and Solopreneurs should be able to build SaaS systems single-handedly without being an expert in every field.
Toh Framework enables you to:
AI now remembers your project structure instantly:
| Memory File | Purpose |
|---|---|
architecture.md | Project structure, routes, data flow |
components.md | Component registry with props |
Benefits:
New security-first approach for AI-generated code:
# Full security audit
/toh-protect
# Quick checks built into /toh-dev and /toh-test
/toh-dev add payment form # → Security check before & after
/toh-test # → Security check before testing
Security Checks:
| Agent | Specialty |
|---|---|
| 🎨 ui-builder | Pages, Components, Layouts |
| ⚙️ dev-builder | Logic, State, API |
| 🔌 backend-connector | Supabase, Auth, RLS |
| ✨ design-reviewer | Polish, Animation |
| 🧪 test-runner | Auto test & fix |
| 🧠 plan-orchestrator | Analyze, Plan |
| 📱 platform-adapter | LINE, Mobile, Desktop |
/toh v4.0 - The Smart Command with full visibility:
/toh create a coffee shop management system
# AI shows you the plan:
📋 Workflow Plan:
├── 1. plan-orchestrator → Analyze requirements
├── 2. ui-builder → Create all pages + components
├── 3. dev-builder → Add state + forms + API
├── 4. design-reviewer → Polish to professional
├── 5. test-runner → Test until pass
└── 6. security-check → Audit before deploy [NEW]
🚀 Executing...
| Feature | Description |
|---|---|
/toh Smart Command | Type anything, AI picks the right agent |
| Sub-Agents | 7 specialized agents for different tasks |
| Multi-Agent Orchestration | Complex workflows with full visibility |
| Premium Experience | 5+ pages with animations in one prompt |
| Design Mastery | 13 business profiles for smart design |
| Auto Memory | Context persists across sessions and IDEs |
| Auto Testing | Test & fix loop until all pass |
# Interactive install (choose IDEs and language)
npx toh-framework install
# Quick install (Claude Code + Cursor, English)
npx toh-framework install --quick
# Specific IDE only
npx toh-framework install --ide claude
npx toh-framework install --ide cursor
npx toh-framework install --ide gemini
npx toh-framework install --ide codex
# Multiple IDEs
npx toh-framework install --ide "claude,cursor,gemini,codex"
# Method 1: Use npx (recommended - always gets latest)
npx toh-framework@latest install
# Method 2: If installed globally
npm update -g toh-framework
toh install
💡 Tip: Reinstalling updates skills, agents, and commands without deleting your existing memory!
# Open project with Claude Code
claude .
# Show all commands
/toh-help
# Smart command - AI picks the right agent
/toh create a landing page with pricing section
# Create complete project
/toh-vibe coffee shop management system
# Add UI
/toh-ui Add a dashboard with sales charts
# Add Logic
/toh-dev Add form validation and API calls
# Improve Design
/toh-design Make it look professional
# Test system
/toh-test
# Security audit
/toh-protect
# Deploy
/toh-ship
# Call Toh agent
@toh Create a meeting room booking system
# Or use specific command
@toh:ui Create a calendar page for room booking
# Start Gemini CLI
gemini
# Use commands
/toh-vibe Inventory management system
| Command | Shortcut | Description |
|---|---|---|
/toh | - | 🧠 Smart Command - Type anything, AI picks agent |
/toh-plan | /toh-p | 📋 Plan - Analyze, plan, orchestrate |
/toh-vibe | /toh-v | 🎨 Create Project - Complete app in one command |
/toh-ui | /toh-u | 🖼️ Create UI - Pages, Components, Layouts |
/toh-dev | /toh-d | ⚙️ Add Logic - TypeScript, Zustand, Forms |
/toh-design | /toh-ds | ✨ Polish Design - Professional, not AI-looking |
/toh-test | /toh-t | 🧪 Test - Auto test & fix until pass |
/toh-protect | /toh-pt | 🔐 Security Audit - Full security check [NEW] |
/toh-connect | /toh-c | 🔌 Connect Backend - Supabase, Auth, RLS |
/toh-line | /toh-l | 💚 LINE Mini App - LIFF integration |
/toh-mobile | /toh-m | 📱 Mobile App - Expo / React Native |
/toh-fix | /toh-f | 🔧 Fix Bugs - Systematic debugging |
/toh-ship | /toh-s | 🚀 Deploy - Vercel, Production ready |
/toh-help | /toh-h | ❓ Help - Show all commands |
No decisions needed - optimized stack ready to go:
| Category | Technology |
|---|---|
| Framework | Next.js 14 (App Router) |
| Styling | Tailwind CSS + shadcn/ui |
| State | Zustand |
| Forms | React Hook Form + Zod |
| Backend | Supabase |
| Testing | Playwright |
| Language | TypeScript (strict) |
AI-Orchestration Driven Development:
User: "Create a coffee shop management system"
Orchestrator:
├── 📐 plan-orchestrator → Analyze & plan
├── 🎨 ui-builder → Create all UI
├── ⚙️ dev-builder → Add logic
├── ✨ design-reviewer → Polish design
├── 🧪 test-runner → Test & fix
├── 🔐 security-check → Audit code [NEW]
└── ✅ Deliver working system!
/toh-vibe Online store with products, cart, and checkout
/toh-vibe Analytics dashboard with charts and date filters
/toh-vibe Project management tool with teams and tasks
[NEW: /toh-protect][NEW: Security Engineer]Contributions are welcome! Please feel free to submit a Pull Request.
MIT License - see LICENSE for details.
Wasin Treesinthuros (Innovation Vantage)
Made with ❤️ for Solo Developers everywhere.
"Type Once, Have it all!"
FAQs
AI-Orchestration Driven Development Framework - Type Once, Have it all!
The npm package toh-framework receives a total of 0 weekly downloads. As such, toh-framework popularity was classified as not popular.
We found that toh-framework demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
The worm-enabled campaign hit @emilgroup and @teale.io, then used an ICP canister to deliver follow-on payloads.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.