
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@a2amesh/cli
Advanced tools
A2A Mesh command-line interface for initialization, validation, conformance, registry operations, and release checks.
Publishes the a2amesh binary for validation, discovery, messaging, registry management, monitoring, benchmarking, diagnostics, and scaffolding.
The supported stable channel is latest.
npm install --global @a2amesh/cli
| Command | Description |
|---|---|
benchmark | Run request benchmarks against an A2A endpoint |
conformance | Run the A2A conformance fixture suite |
conformance-badge | Generate a conformance badge SVG from a report |
discover | Resolve and print an endpoint Agent Card |
doctor | Print local CLI diagnostics |
export-card | Export an endpoint Agent Card to JSON |
health | Check an A2A endpoint health route |
monitor | Poll task status snapshots |
registry | Start, inspect, export, and import registry state |
release-check | Check release readiness |
scaffold | Create an A2A agent project scaffold |
send | Send a text message to an A2A endpoint |
task | Run task lifecycle operations |
validate | Validate an Agent Card file or endpoint |
Run a2amesh <command> --help for usage and options.
| Code | Meaning |
|---|---|
0 | Success |
1 | Command error or conformance failure |
See Compatibility for supported Node.js, protocol, transport, package, and peer ranges.
Network commands use the shared outbound policy. Loopback URLs are accepted for local
workflows, while other private-network destinations require the explicit
--allow-private-network flag. Redirects are revalidated, DNS is pinned to the validated
address set, response bodies are bounded, and URL query values and credentials are
redacted from telemetry.
--timeout-ms is a total operation deadline. --retries applies only to idempotent
requests or requests carrying an Idempotency-Key; ordinary message-send POSTs are not
replayed automatically.
FAQs
A2A Mesh command-line interface for initialization, validation, conformance, registry operations, and release checks.
The npm package @a2amesh/cli receives a total of 9 weekly downloads. As such, @a2amesh/cli popularity was classified as not popular.
We found that @a2amesh/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.