
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@authup/client-admin-console
Advanced tools
Authup's admin console: the administration SPA, served by server-core at /console/admin and hostable standalone.
This is the admin console for Authup, a flexible and secure authentication and
authorization system: a client-only Vue SPA that @authup/server-core serves
at <publicUrl>/console/admin. The package ships the built dist/ only; there is no
server process and no binary.
Served by server-core (the default): nothing to configure. The server injects
the runtime configuration into the shell per request and authenticates the
console with its opaque session cookie. ADMIN_CONSOLE_ENABLED=false turns
the route into a disabled notice; ADMIN_CONSOLE_PATH points server-core at a
substituted package directory.
Standalone hosting: serve dist/ under the /console/admin base path (or any other, injected as basePath) on any static
host (every deep link must answer with index.html), inject the
configuration by replacing the <!--admin-config--> marker in index.html
with <script>window.__AUTHUP__ = { apiUrl: 'https://auth.example.com' };</script>
(optional keys: basePath, clientId), and list the host's origin in the
server's TRUSTED_ORIGINS. On a foreign origin the console signs in through
the browser-side authorization-code flow instead of the session cookie.
VITE_API_URL=http://localhost:3000 npm run dev # vite on http://localhost:5173/console/admin/
npm run build # dist/, what server-core serves
npm run test
Made with 💚
Published under the AGPL-3.0 License. A commercial license is available for organizations that cannot meet the AGPL's conditions. See LICENSING.md or contact contact@tada5hi.net.
FAQs
Authup's admin console: the administration SPA, served by server-core at /console/admin and hostable standalone.
The npm package @authup/client-admin-console receives a total of 0 weekly downloads. As such, @authup/client-admin-console popularity was classified as not popular.
We found that @authup/client-admin-console demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.