@askalf/hands
Cross-platform computer-use agent. Your LLM on your mouse, keyboard, and screen. Windows (PowerShell), macOS (open + osascript), Linux (xdotool / ydotool). Voice optional, safety guardrails. Routes through dario or any Anthropic-compat endpoint.
Supply chain provenance
Status for the latest visible version.
Maintainers
Keywords
Versions (showing 26 of 26)
| Version | Deps | Published |
|---|---|---|
| 0.22.0 | 6 / 4 | |
| 0.21.1 | 6 / 4 | |
| 0.21.0 | 6 / 3 | |
| 0.20.0 | 6 / 3 | |
| 0.19.0 | 6 / 3 | |
| 0.18.0 | 6 / 3 | |
| 0.17.0 | 6 / 3 | |
| 0.16.0 | 6 / 3 | |
| 0.15.0 | 6 / 3 | |
| 0.14.0 | 6 / 3 | |
| 0.13.0 | 6 / 3 | |
| 0.12.0 | 6 / 3 | |
| 0.11.0 | 6 / 3 | |
| 0.10.0 | 6 / 3 | |
| 0.9.0 | 6 / 3 | |
| 0.8.0 | 6 / 3 | |
| 0.7.0 | 6 / 3 | |
| 0.6.0 | 6 / 3 | |
| 0.5.0 | 6 / 3 | |
| 0.4.3 | 6 / 3 | |
| 0.4.2 | 6 / 3 | |
| 0.4.1 | 7 / 3 | |
| 0.4.0 | 7 / 3 | |
| 0.3.0 | 6 / 3 | |
| 0.2.0 | 6 / 3 | |
| 0.1.0 | 6 / 3 |
v0.22.0
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (askalf) on 2026-07-19, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.21.1
2 findingsPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
This version was published by a different npm account (GitHub Actions) than the most recent previously approved version (askalf) on 2026-07-12, but it carries Sigstore provenance attestation. This means the package moved to a trusted publisher (CI/CD with OIDC, e.g. GitHub Actions) — a supply-chain integrity improvement, not a compromise, since a stolen npm token cannot forge provenance bound to the source repository. Recorded as INFO for audit trail.
v0.21.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.20.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.19.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.18.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.17.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.16.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.15.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.
v0.14.0
1 findingPublished via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.