
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@bingran/mews
Advanced tools
A local GitHub notification daemon that scopes work to allow-listed repos and dispatches local coding agents.
mews is a local GitHub notification daemon for a small set of repos you
explicitly allow. It polls notifications, keeps a local inbox under
~/.mews/, serves a browser dashboard, and can dispatch Codex CLI or Claude
Code work for actionable items.
The daemon only acts on repos you pass through --allow-repo. That keeps the
runtime predictable and avoids accidentally scanning or scheduling work for the
rest of your GitHub account.
gh) authenticated for the host you want to pollnpm install -g @bingran/mews
mews --version
pnpm install
pnpm build
pnpm link --global
mews --version
mews install --allow-repo bingran-you/mews
mews status
Then open http://127.0.0.1:7878/dashboard.
Daemon-starting commands require an explicit repo scope:
mews start --allow-repo owner/repo
mews start --allow-repo owner/repo,owner/*
Use mews help <command> or mews <command> --help for command details.
mews install --allow-repo ... checks gh, writes config.yaml if needed, and starts the daemonmews start --allow-repo ... launches the daemon in the backgroundmews stop stops the background daemonmews status prints the current lock and runtime statusmews doctor diagnoses auth, lock, and runtime statemews poll runs one notifications poll without starting the daemonmews watch opens the local TUI inboxmews run-once --allow-repo ... runs one full daemon cycle and exitspnpm verify
That runs the same build, typecheck, and unit test flow used in CI.
For the repo-scoped live harness that starts the real background service and verifies the dashboard end to end:
pnpm e2e:live
See CONTRIBUTING.md for the local development loop and the live end-to-end harness.
FAQs
A local GitHub notification daemon that scopes work to allow-listed repos and dispatches local coding agents.
The npm package @bingran/mews receives a total of 0 weekly downloads. As such, @bingran/mews popularity was classified as not popular.
We found that @bingran/mews demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.