
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@authup/client-auth-console
Advanced tools
Authup's auth console: the SSR auth workflow UI (authorize, register, activate, password recovery, logout) rendered by server-core on the IdP origin.
The auth console: authup's SSR auth workflow UI. It renders the hosted pages
on the IdP origin — /authorize (login + consent), /register, /activate,
/password-forgot, /password-reset and /logout.
This package is not a standalone application. @authup/server-core depends on
it, renders each request through the built server bundle
(dist/server/server.js) with a per-request hydration payload, and serves the
client assets (dist/client/). The auth pages are architecturally inseparable
from the IdP origin (WebAuthn origin binding, first-party session cookies,
same-path GET-HTML/POST-JSON routes), so there is nothing meaningful to host
without server-core.
The supported boundary between server-core and this package is the render
contract in src/contract.ts (render(RenderContext) => RenderResult).
Operators who want a custom login/consent UI can substitute this package with
one that fulfills the same contract instead of forking server-core.
To find out how to use Authup, visit the documentation.
Distributed under the AGPL-3.0-only license (with a commercial license
available). See the LICENSE file and the repository's LICENSING.md for
details.
FAQs
Authup's auth console: the SSR auth workflow UI (authorize, register, activate, password recovery, logout) rendered by server-core on the IdP origin.
The npm package @authup/client-auth-console receives a total of 143 weekly downloads. As such, @authup/client-auth-console popularity was classified as not popular.
We found that @authup/client-auth-console demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.