
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@aioproductoscom/node
Advanced tools
AIOProductOS server-side analytics for Node.js — identity-first backend events (signup, payment, subscription, churn) onto the AIOProductOS spine. Zero dependencies.
Server-side analytics for AIOProductOS. Send identity-first backend events — signup, payment, subscription, churn — straight to the AIOProductOS spine, where they join the same customer record as your web/product analytics, feedback, and revenue. Zero dependencies, Node 18+.
npm install @aioproductoscom/node
import { ProductOS } from "@aioproductoscom/node";
// Use a SECRET ingest key (sk_live_…) from your AIOProductOS workspace —
// server-side only, never ship to a browser.
const pos = new ProductOS({ apiKey: process.env.PRODUCTOS_KEY! });
// A backend truth event the browser can't be trusted to report:
pos.capture({
event: "subscription_started",
distinctId: user.id,
properties: { plan: "scale", mrr: 99, currency: "EUR" },
});
pos.identify({ distinctId: user.id, traits: { email: user.email, plan: "scale" } });
pos.revenue(user.id, 99, "EUR", { plan: "scale" });
// On graceful shutdown, flush anything queued:
await pos.shutdown();
Events are queued and flushed in batches automatically (and on shutdown()),
so calls never block your request path. The region is read from your key.
A browser can drop events (ad blockers, closed tabs) and can't be trusted for money. Revenue, signups, and subscription changes are reported from your backend — so the numbers your dashboards, funnels, and AI teammates reason about are real.
@aioproductoscom/react-nativeFAQs
AIOProductOS server-side analytics for Node.js — identity-first backend events (signup, payment, subscription, churn) onto the AIOProductOS spine. Zero dependencies.
The npm package @aioproductoscom/node receives a total of 0 weekly downloads. As such, @aioproductoscom/node popularity was classified as not popular.
We found that @aioproductoscom/node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.