
Research
/Security News
Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
Popular npm packages keyv and cacheable compromised.
Your agent coding session as a short recap video — Hyperframes (HTML/CSS/JS) with zero gen-video keys, or your own video model. For Claude Code, Codex, Gemini, and other agentic CLIs. Local-first.
Your vibe coding session, as a movie.
Transforms your AI-assisted coding activity into a cinematic, narrated video — complete with chapters, a storyline, dramatic music, and visual effects. Not a screen recording. A movie.
▶ Watch the launch video — what if claude made a movie about your PR?
https://github.com/pooriaarab/vibemovie/raw/main/branding/launch-video.mp4
npm i -g vibemovie
# or run it directly
npx vibemovie --help
# render a session recap from a JSON events file (or stdin)
vibemovie render session.json
# → writes ./vibe-recap.html — open it in any browser
vibemovie render session.json --ratio 9:16 --template speedrun --out recap.html
cat session.json | vibemovie render
# expose the render tool to your agent
vibemovie mcp
The default engine is Hyperframes: the recap is a self-contained animated HTML page rendered fully offline — zero API keys, no network, nothing leaves your machine. (Gen-video providers like Sora/Wavespeed slot into the cascade above it later; v0 ships the guaranteed floor.)
Input is a JSON array of events (or { "events": [...] }):
[
{ "kind": "task-done", "ts": 1769500000000, "agent": "claude-code", "cwd": "/repo/demo",
"payload": { "label": "Refactor auth middleware", "durationMin": 18 } },
{ "kind": "tests-pass", "ts": 1769503600000, "payload": { "passed": 42 } },
{ "kind": "pr-merged", "ts": 1769505100000, "payload": { "pr": 42, "branch": "main" } }
]
Library usage:
import { renderMovie } from 'vibemovie';
const { html, path } = await renderMovie(events, {
ratio: '16:9', // '16:9' | '9:16' | '1:1'
template: 'documentary', // 'documentary' | 'speedrun' | 'meme'
out: 'recap.html', // optional — omit to just get the HTML string
});
buildScenes(events) (events → scene list) and renderHyperframes(scenes) (scene list → HTML) are pure and exported for custom pipelines.
Video generation follows the shared @vibe/core cascade so it always works:
Options across all tiers: sync/live (scenes build as the agent works) or async (rendered after a turn/session) — user-configurable per hook · aspect ratios 16:9 / 9:16 / 1:1 / GIF · sound on/off (soundtrack via the VibeRadio engine + optional narration) · subtitles/captions · transitions & templates (documentary, tutorial, speedrun, meme) · avatar narrator — if you've set up a personal likeness/voice (e.g. HeyGen, or an on-device avatar), the recap can be narrated by your avatar instead of an abstract summary.
vibemovie render session.json (today) · --session <id> / --repo . (planned)npm install -g vibemovievibemovie mcp exposes a render tool your agent can call/vibemovie to render your last sessionInteractive, self-contained UX prototype (no build, no network): open
docs/prototype.html in a browser — it plays a real
Hyperframes recap with a working scrubber, the cascade selector, and an avatar
narrator toggle.
Runs on your own machine. The Hyperframes tier renders fully offline; nothing leaves
your machine unless you opt into a hosted video model. Enforced by the @vibe/core
consent model.
Part of the Vibe Suite — companion tools for agentic coding CLIs (Claude Code, Codex, Cursor, Gemini, Grok, pi, Kimi, and other harnesses). Ships as CLI + npm package + MCP server.
FAQs
Your agent coding session as a short recap video — Hyperframes (HTML/CSS/JS) with zero gen-video keys, or your own video model. For Claude Code, Codex, Gemini, and other agentic CLIs. Local-first.
The npm package vibemovie receives a total of 138 weekly downloads. As such, vibemovie popularity was classified as not popular.
We found that vibemovie demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Popular npm packages keyv and cacheable compromised.

Security News
A misconfiguration gave three Anthropic models internet access, and one, believing it was in a simulation, shipped a credential-stealing package to PyPI.

Security News
/Company News
Socket has joined the new Composer and Packagist sponsorship program as a launch sponsor, supporting the team that keeps PHP's package ecosystem secure.