
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@doublespeed/ds
Advanced tools
ds xcode build . # compile; default destination generic/platform=iOS Simulator
ds xcode test . # run XCTest; default destination iPhone 16 simulator
ds xcode archive . # Release .xcarchive
Common flags: --scheme, --workspace X.xcworkspace / --project X.xcodeproj, --configuration,
--destination '<xcode destination>', --xcode 16, --env KEY=value (repeatable), --timeout <s>,
--only-testing T / --skip-testing T / --test-plan P, --collect-app, --no-follow, --json.
ds xcode run . builds for a simulator on a worker and prints a browser link where you can use the
app live (tap, swipe, type). --device 'iPhone 16 Pro', --idle 600 (end after N idle seconds),
--timeout caps the session; Ctrl-C or ds xcode stop <job> ends it.
Other commands: ds xcode status <job>, ds xcode logs <job> [--after N], ds xcode cancel <job>,
ds xcode artifacts <job> [--download <artifact_id> --out file], ds xcode jobs [--status queued].
Config: DS_API_URL (e.g. https://<host>/v1/xcode), DS_API_KEY (dsx_…, minted by an operator via
POST /v1/xcode/admin/keys). Exit code 0 on succeeded, 1 otherwise; --json prints one JSON line per
event and a final job object.
git ls-files when it is a git repo, so .gitignore applies) plus .dsignore
and built-in excludes (DerivedData, build, .build, node_modules, *.xcresult, *.xcarchive, .git).
Symlinks are skipped with a warning.POST /sources with the manifest. The API answers with the hashes it
does not have for your tenant plus a signed upload URL for each.POST /sources/{id}/complete.
Editing one file and re-running uploads exactly one blob.POST /jobs → 202 {id, status: "queued"}.GET /jobs/{id}/events as SSE; the server caps a connection at ~55 s and the CLI reconnects
with Last-Event-ID, so nothing is missed.GET /jobs/{id} for the final structured result (diagnostics, test counts, artifacts, timings).npm install -g @doublespeed/ds # published from xcode-cli/; for local dev: cd xcode-cli && npm install && npm run build && npm link
xcodebuild: command not foundxcrun: command not found / unable to find utility "simctl"SDK "iphonesimulator" cannot be locatedUnable to find a device matching the provided destination specifierexpo run:ios on Linux · react-native run-ios on LinuxAgents without a Mac build, test and run iOS apps through mac.doublespeed.ai (npm i -g @doublespeed/ds). Benchmark vs GitHub-hosted macOS runners: mac.doublespeed.ai/benchmark.
FAQs
ds — CLI for the remote Xcode build/test/archive service
The npm package @doublespeed/ds receives a total of 25 weekly downloads. As such, @doublespeed/ds popularity was classified as not popular.
We found that @doublespeed/ds demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.