
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@balancer-labs/v2-pool-utils
Advanced tools
This package contains Solidity utilities for developing Balancer V2 Pools, implementing common patterns such as token decimal scaling, caller checks on hooks, etc.
The most useful contracts are BaseGeneralPool and BaseMinimalSwapInfoPool, used as base contracts for Pools with the General and MinimalSwapInfo/TwoTokens specializations respectively.
The recommended pattern is to create new Pools from factory contracts, as that lets other systems reason about Pool logic by checking whether a Pool was deployed from a given factory. BasePoolFactory can be used for this purpose.
$ npm install @balancer-labs/v2-pool-utils
Contracts in this package are meant to be used via inheritance to develop new Pools. The BaseGeneralPool and BaseMinimalSwapInfoPool contracts are abstract, meaning some virtual functions (such as _onJoinPool or _onSwapGivenIn) are not defined: derived contracts must override them and provide an implementation.
See v2-pool-weighted for the implementation of Pools with a Constant Weighted Product invariant using these base contracts.
FAQs
Utilities for creating Balancer V2 Pools
The npm package @balancer-labs/v2-pool-utils receives a total of 69 weekly downloads. As such, @balancer-labs/v2-pool-utils popularity was classified as not popular.
We found that @balancer-labs/v2-pool-utils demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.