
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
Developer learning tool — analyze coding sessions, extract concepts, generate quiz questions
Quick Start • How It Works • VL CLI • Configuration • Privacy • Troubleshooting
VibeLearn is a Claude Code plugin that silently watches what you build, extracts the concepts you encounter, and turns them into quiz questions — so you actually retain what you learn while coding.
Every time you end a Claude Code session, VibeLearn automatically:
package.json, pyproject.toml, go.mod, etc.multiple_choice, code_reading, spot_the_bug, fill_in_blank, open_ended, true_false, and ordering — selected based on concept difficulty (junior / mid / senior)vl login)Then run vl quiz to review what you learned.
Install the plugin in a Claude Code session:
/plugin marketplace add anergcorp/vibelearn
/plugin install vibelearn
Restart Claude Code. VibeLearn will start capturing learning data automatically from your next session.
Optional — connect to vibelearn.dev:
vl login <your-api-key>
Get your API key at vibelearn.dev.
The vl command lets you review and interact with your learning data:
vl quiz # Interactive quiz — all pending questions
vl quiz --session # Quiz questions from the last session only
vl status # Sessions analyzed, top concept categories, mastery stats
vl gaps # Concepts you haven't mastered yet (mastery < 50%)
vl login <api-key> # Connect to vibelearn.dev
vl login --status # Check login status
Example session:
$ vl quiz
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
VibeLearn Quiz — 3 questions
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Q1/3 (intermediate) [React Server Actions]
Code:
'use server'
export async function createPost(data: FormData) { ... }
What does the 'use server' directive tell Next.js?
A) Run this function in a Web Worker
B) Execute this function on the server, not the client
C) Cache the function result server-side
D) Mark the function as async-only
Your answer (A/B/C/D): B
✓ Correct!
Explanation: 'use server' creates a Server Action — a function that
runs exclusively on the server. The client receives only the result.
VibeLearn tracks your mastery per concept and adjusts difficulty automatically:
SessionStart → Worker starts, session initialized
UserPromptSubmit → Session linked to user prompt
PostToolUse → File edits/writes/bash commands captured
Stop (Summary) → 5-step analysis pipeline runs
SessionEnd → Session finalized
1. StackDetector — reads package.json/config files → vl_stack_profiles
2. StaticAnalyzer — regex/AST patterns on code changes (hooks, routes, types…)
3. ConceptExtractor — LLM call → session summary + concept list → vl_concepts
4. QuizGenerator — LLM call → quiz questions per concept → vl_questions
5. UpstreamSync — HMAC-signed POST to api.vibelearn.dev (queued offline if unavailable)
An Express HTTP server on port 37778, managed by Bun. Hooks talk to it over localhost. It handles all database writes and the analysis pipeline.
SQLite at ~/.vibelearn/vibelearn.db. Key tables:
| Table | Purpose |
|---|---|
vibelearn_session_summaries | Human-readable session narratives |
vl_concepts | Extracted concepts per session |
vl_questions | Generated quiz questions |
vl_quiz_attempts | Your answers (HMAC-signed before sync) |
vl_developer_profile | Mastery score per concept |
vl_stack_profiles | Detected tech stack per session |
vl_sync_queue | Offline retry queue |
Settings are auto-created at ~/.vibelearn/settings.json on first run.
Key settings:
{
"VIBELEARN_WORKER_PORT": "37778",
"VIBELEARN_DATA_DIR": "~/.vibelearn",
"VIBELEARN_LOG_LEVEL": "INFO",
"VIBELEARN_PROVIDER": "claude",
"VIBELEARN_GEMINI_API_KEY": "",
"VIBELEARN_OPENROUTER_API_KEY": "",
"VIBELEARN_AUTO_SYNC": "true",
"VIBELEARN_EXCLUDED_PROJECTS": ""
}
AI Provider for Analysis
The analysis pipeline (concept extraction + quiz generation) uses your configured LLM provider. Priority order:
VIBELEARN_GEMINI_API_KEY (free tier available)VIBELEARN_OPENROUTER_API_KEYANTHROPIC_API_KEY from environment (claude-haiku-4-5)Excluding projects:
{
"VIBELEARN_EXCLUDED_PROJECTS": "/path/to/skip,~/personal/*"
}
Wrap any content in <private> tags to prevent it from being stored or synced:
Please review <private>my-secret-api-key: sk-...</private> configuration
Everything inside <private> is stripped at the hook layer before reaching the worker or database.
What is never stored:
Anti-tamper: Quiz attempt records are HMAC-signed with your API key before syncing. The server recomputes your streak from accepted attempt records — local SQLite data cannot be used to fake progress.
If you see npm : The term 'npm' is not recognized:
Install Node.js and restart your terminal. Bun is auto-installed by the plugin setup script.
npm install
npm run build-and-sync # Build + sync to marketplace + restart worker
Built outputs land in plugin/scripts/:
worker-service.cjs — the worker daemonmcp-server.cjs — MCP toolsvl-cli.cjs — the vl binaryGNU Affero General Public License v3.0 (AGPL-3.0).
See the LICENSE file for full details.
Built with Claude Agent SDK | Powered by Claude Code | Made with TypeScript
FAQs
Developer learning tool — analyze coding sessions, extract concepts, generate quiz questions
The npm package vibelearn receives a total of 2 weekly downloads. As such, vibelearn popularity was classified as not popular.
We found that vibelearn demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.