todai
Wednesday, 13 May
5 min read · 924 words

ACTION NEEDED

  • TanStack npm supply chain attack — check your .claude/ directory now. Yesterday (May 11), 42 @tanstack/* npm packages were compromised with malware that harvests AWS, GitHub, SSH, and npm credentials and self-propagates to other packages you maintain. Critically: the malware writes persistence artifacts to .claude/ and .vscode/ that survive npm uninstall. If you ran npm install on May 11: rotate all credentials, delete node_modules and reinstall, then run rm -f .claude/router_runtime.js .claude/setup.mjs and run git diff .claude/settings.json. Clean versions confirmed fixed. Source: TanStack postmortem + StepSecurity | https://tanstack.com/blog/npm-supply-chain-compromise-postmortem

REDDIT SIGNAL

  • Showcase — Community member built Clawdmeter, a $32 ESP32 AMOLED device that monitors your Claude Code usage limits in real time and shows them on a 480×480 screen — open source, full build guide and source code included — 1,363 upvotes, 65 comments | r/ClaudeCode | https://www.reddit.com/r/ClaudeCode/comments/1takxpl/
  • millionco/react-doctor — 804★ today (8,647★ total) — static analyser that catches the bad React patterns AI-generated code reliably produces (unnecessary useEffect, prop drilling, missing keys, stale closures) | npx react-doctor | https://github.com/millionco/react-doctor

TODAY'S ITEMS

1. Production-Ready Multi-Agent Workflows as a Claude Code Plugin

  • shinpr/claude-code-workflows ships a plug-and-play plugin that wires up specialized agents for requirements, design, implementation, and quality checks across backend, frontend, and fullstack projects — you call /recipe-implement <feature> or /recipe-fullstack-implement "<task>" and the pipeline runs end-to-end, producing code that passes tests and matches design docs.
  • The plugin ecosystem is growing: companion plugins cover PRD generation (claude-code-discover), shortcut-taking detection (metronome), and Linear task decomposition (linear-prism), all installable from the same marketplace.
  • Source: GitHub
  • Why it matters: Run /plugin marketplace add shinpr/claude-code-workflows and you get a full spec-driven dev workflow — design doc, implementation, cross-layer consistency check — without writing any orchestration yourself.
  • Verified

2. LLM Shebang Lines: Executable English Text Files

  • Simon Willison published a TIL showing you can put #!/usr/bin/env -S llm -f as the shebang of a plain text file — the file becomes a directly executable LLM prompt, with optional tool calls (-T tool_name) or YAML templates that define Python functions as tools.
  • Works with any model supported by the llm Python package (which supports Claude via plugins), meaning you can write a plain English script, chmod +x it, and run it from the terminal like any shell command.
  • Source: simonwillison.net
  • Why it matters: If you use the llm CLI, this unlocks a new automation pattern — store your frequently used prompts as executable files in your PATH and run them directly without opening any interface.
  • Verified

3. GitLab Cuts Management Layers and Bets on the Agentic Era

  • GitLab announced workforce reductions, removing up to 3 layers of management in some functions, reorganising into ~60 smaller end-to-end teams, and explicitly framing the move as a response to "the agentic era" — the belief that smaller empowered teams with AI agents can outperform larger siloed ones.
  • Simon Willison noted the sharp tension: GitLab's business depends on developer tooling growing as a market, so their optimism about agents multiplying software demand is self-interested — but the structural changes are real regardless of the framing.
  • Source: simonwillison.net / GitLab
  • Why it matters: When a major dev platform restructures around the premise that small teams with AI agents replace large ones, it's a signal about how enterprise software buyers and tool vendors are thinking about staffing — which affects what tools they'll buy and build.
  • Verified

NEW TOOL / PRODUCT SPOTLIGHT

  • shinpr/claude-code-discover — companion to claude-code-workflows that turns a rough feature idea into a structured, evidence-backed PRD before any code is written; installs in Claude Code as /plugin install discover@claude-code-workflows | https://github.com/shinpr/claude-code-discover

PROMPT OF THE DAY

You are about to implement: [FEATURE NAME]

Before writing any code:
1. Read CLAUDE.md, README, and any relevant design docs
2. List the files you expect to change and why
3. Identify 3 edge cases or integration points
   that could break existing functionality
4. Propose a test plan: which tests to add
   or modify, and what each should verify

Only begin implementation once I confirm
the plan. If anything is ambiguous, ask now.

Community-sourced from shinpr/claude-code-workflows — this is the pre-implementation gate the dev-workflows plugin enforces before every recipe run. Use in Claude Code before starting any non-trivial feature. https://github.com/shinpr/claude-code-workflows

LANDSCAPE NOTES

  • OpenAI announced the "OpenAI Deployment Company" — 150 forward-deployed engineers and $4B from 19 partners to embed in enterprise customer operations. Palantir model. Not directly a Claude story but signals the competitive pressure on enterprise deployment. https://news.smol.ai/issues/26-05-11-not-much/

  • James Shore (via simonwillison.net): if you double your code output with AI but don't halve maintenance costs, you've doubled your maintenance burden — the math for AI-assisted coding only works if the agent actively reduces future maintenance, not just accelerates production. Worth reading if you're building long-lived code with Claude Code. https://simonwillison.net/2026/May/11/james-shore/

  • Simon Willison's GitLab note also flags that developer platform pricing is shifting from "tens of dollars/user/month" to "hundreds/user/month and headed to thousands" — Jevons paradox territory, more demand as capability expands. https://simonwillison.net/2026/May/11/gitlab-act-2/