
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@aimarket/agent
Advanced tools
AI Market Protocol v2 consumer SDK for TypeScript — Electron, Node.js, web apps
AI Market Protocol v2 consumer SDK for TypeScript — Electron, Node.js servers, and web apps.
Discover, pay for, and invoke AI capabilities from the decentralized marketplace, with production cryptography:
ed25519:<base64>) for canonical hub / invoke signatureskeccak256 + secp256k1, eip712:0x<r><s><v>) for on-chain channel debitsPart of the AIMarket SDKs (Dart · TypeScript · Rust) — all three ship the same version and the same model shapes, enforced by an ecosystem parity guard in CI.
# Published on npm (v0.1.1+ — CommonJS require() on Node 20/22):
npm install @aimarket/agent
# ESM / TypeScript:
import { AimarketAgent } from '@aimarket/agent';
# CommonJS:
const { AimarketAgent } = require('@aimarket/agent');
import { AimarketAgent } from '@aimarket/agent';
const agent = new AimarketAgent({
hubUrl: 'https://modelmarket.dev',
walletKey: loadYourWalletKey(),
});
// Discover capabilities for an intent — returns a ranked PlanStep[].
const plan = await agent.discover({
intent: 'ATS scoring rules for fintech roles',
budget: 1.0,
limit: 5,
});
// Open a $5 channel (good for ~50 calls), then invoke the best match.
const channel = await agent.openChannel(5.0);
const result = await agent.invoke({
capabilityId: plan[0].capability.capability_id,
input: { target_role: 'Senior PM', industry: 'fintech' },
channelId: channel.channel_id,
});
console.log('Output:', result.result, '· cost $', result.price_usd, '· TEE', result.tee_verified);
await agent.closeChannel(channel.channel_id);
MIT
FAQs
AI Market Protocol v2 consumer SDK for TypeScript — Electron, Node.js, web apps
We found that @aimarket/agent demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.