
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@a2amesh/cli
Advanced tools
A2A Mesh command-line interface for initialization, validation, conformance, registry operations, and release checks.
Publishes the a2amesh binary for validation, discovery, messaging, registry management, monitoring, benchmarking, diagnostics, and scaffolding.
| Command | Description |
|---|---|
benchmark | Run request benchmarks against an A2A endpoint |
conformance | Run the A2A conformance fixture suite |
conformance-badge | Generate a conformance badge SVG from a report |
discover | Resolve and print an endpoint Agent Card |
doctor | Print local CLI diagnostics |
export-card | Export an endpoint Agent Card to JSON |
health | Check an A2A endpoint health route |
monitor | Poll task status snapshots |
registry | Start, inspect, export, and import registry state |
release-check | Check release readiness |
scaffold | Create an A2A agent project scaffold |
send | Send a text message to an A2A endpoint |
task | Run task lifecycle operations |
validate | Validate an Agent Card file or endpoint |
Run a2amesh <command> --help for usage and options.
| Code | Meaning |
|---|---|
0 | Success |
1 | Command error or conformance failure |
See Compatibility for supported Node.js, protocol, transport, package, and peer ranges.
Network commands use the shared outbound policy. Loopback URLs are accepted for local
workflows, while other private-network destinations require the explicit
--allow-private-network flag. Redirects are revalidated, DNS is pinned to the validated
address set, response bodies are bounded, and URL query values and credentials are
redacted from telemetry.
--timeout-ms is a total operation deadline. --retries applies only to idempotent
requests or requests carrying an Idempotency-Key; ordinary message-send POSTs are not
replayed automatically.
FAQs
A2A Mesh command-line interface for initialization, validation, conformance, registry operations, and release checks.
The npm package @a2amesh/cli receives a total of 9 weekly downloads. As such, @a2amesh/cli popularity was classified as not popular.
We found that @a2amesh/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.