
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@aioproductoscom/mcp-pm
Advanced tools
ProductOS PM Helper — an MCP server to manage ProductOS tickets from Claude Code, Cursor, Codex, and any MCP host.
Manage ProductOS tickets from your AI host — Claude Code, Cursor, Codex, or any MCP client. List, create, update, and comment on tasks, grounded in the ProductOS spine (features, insights). Thin and secret-free: the only credential is your personal access token, which you paste into your host's config.
In ProductOS → Settings → Tokens & Agents → Generate token. Copy it (shown
once) — it looks like pat_live_….
claude mcp add productos-pm -e PRODUCTOS_TOKEN=pat_live_… -- npx -y @aioproductoscom/mcp-pm
or in .mcp.json:
{
"mcpServers": {
"productos-pm": {
"command": "npx",
"args": ["-y", "@aioproductoscom/mcp-pm"],
"env": { "PRODUCTOS_TOKEN": "pat_live_…" }
}
}
}
Same shape in their mcp.json: command: "npx", args: ["-y", "@aioproductoscom/mcp-pm"],
env.PRODUCTOS_TOKEN.
PRODUCTOS_URL defaults to https://platform.aioproductos.com; set it to point at a
self-hosted platform.
| Tool | What it does |
|---|---|
whoami | the connected org + member |
pm_meta | lists / statuses / members / features (resolve names → ids) |
list_tasks | list tasks (filter by status_id, list_id) |
get_task | one task + comments + assignees |
create_task | new task; feature_id / insight_id link it to the spine |
update_task | change status, priority, fields, assignees |
comment_on_task | add a comment |
get_product_brain | a grounded read-only snapshot of your product (revenue, accounts, web + product analytics, features, signals, open work) — so your host model reasons about it on your own subscription |
pnpm install
pnpm --filter @aioproductoscom/mcp-pm build
Then point the host at the built binary instead of npx:
{ "command": "node", "args": ["<repo>/packages/mcps/productos-pm/dist/index.js"],
"env": { "PRODUCTOS_TOKEN": "pat_live_…" } }
FAQs
ProductOS PM Helper — an MCP server to manage ProductOS tickets from Claude Code, Cursor, Codex, and any MCP host.
The npm package @aioproductoscom/mcp-pm receives a total of 0 weekly downloads. As such, @aioproductoscom/mcp-pm popularity was classified as not popular.
We found that @aioproductoscom/mcp-pm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.