
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
On-machine component of xSwarm. Runs under CC OAuth subscription — no per-token API cost.
npx xswarm
└─► daemon (PM2-managed Node.js)
├─► foreman (CC session in tmux + xswarm-channel MCP)
│ └─► tools: report_status, request_worker, relay_to_user,
│ get_projects, get_project_status, check_worker_status
└─► workers (headless claude -p sessions in tmux)
└─► execute TDD loops in project git worktrees
| File | Purpose |
|---|---|
foreman.js | Foreman CC session lifecycle — start, monitor, restart (max 10). Writes MCP config, injects system instructions. |
worker.js | Spawns headless claude -p workers in tmux windows. Tracks worker state per project. |
terminal-relay.js | Reads tmux pane output via capture-pane, streams to API as terminal:output WebSocket messages. |
devserver-relay.js | HTTP dev server proxy. Receives http_req from dashboard, forwards to local port, sends http_res back. |
tmux-manager.js | tmux session and window management. Session prefix: xswarm. |
claude-executor.js | Launches CC processes with correct flags, MCP config, and system prompt. |
auth.js | Loads ~/.xswarm config: auth token, machine ID. |
websocket.js | Persistent WebSocket connection to API relay. Auto-reconnects on drop. |
api-client.js | REST calls to api.xswarm.ai for project registration and status. |
project-db.js | Local SQLite for project registry and worker tracking. |
daemon-entry.js | PM2 entry point. Starts all subsystems in order. |
setup.js | First-run setup: GitHub OAuth, machine registration, config file. |
| File | Purpose |
|---|---|
xswarm-channel.js | MCP stdio server. Exposes 6 tools to foreman. Bridges CC ↔ API via WebSocket. |
foreman-instructions.md | System prompt for the foreman CC session. BA persona. Audio-optimized response rules. |
report_status(project_id, summary, status)
// status: 'idle' | 'working' | 'blocked' | 'complete'
// Pushes to dashboard via API relay
request_worker(project_id, task, context)
// Spawns headless claude -p in a tmux window, returns worker_id
relay_to_user(message)
// Sends chat:response through API relay to all connected dashboards
get_projects()
// Returns list of projects registered on this machine
get_project_status(project_id)
// Returns cached status from API relay
check_worker_status(worker_id)
// Returns: 'running' | 'complete' | 'error' | 'not_found'
From foreman-instructions.md:
report_status on every meaningful state changerelay_to_user only for information the user needs to act onrequest_worker with full context so they can work without callbacksEach worker is a headless claude -p session in a tmux window:
.xswarm/ state files in the project worktreecheck_worker_status, relays progress via report_statusnpm run dev # Start daemon in development mode (nodemon)
npm run build # Build CLI for publishing
npm run test # Run vitest test suite
npm run lint # ESLint check
FAQs
xSwarm - AI-powered project orchestrator daemon
The npm package xswarm receives a total of 50 weekly downloads. As such, xswarm popularity was classified as not popular.
We found that xswarm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.