
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@forgemeshlabs/travel-assistant-mcp
Advanced tools
No-key travel MCP for Claude Desktop, Codex-style agents, Hermes, and other clients.
DO NOT USE THIS REPO! READ TRAVEL-REPO-MAP.md ASAP
No-key travel assistant for Claude Desktop, Codex-style agent workflows, Hermes, and other MCP clients. It helps agents look up airports, compare routes, explain travel timing, and build external booking links without requiring a travel API account.
npm install -g @forgemeshlabs/travel-assistant-mcp
Add this to your Claude Desktop claude_desktop_config.json:
{
"mcpServers": {
"travel-assistant": {
"command": "npx",
"args": ["-y", "@forgemeshlabs/travel-assistant-mcp"]
}
}
}
Restart Claude Desktop after saving the config, then ask Claude to plan or compare travel routes.
Codex, Hermes, and other MCP-capable agent runtimes can use the same server command:
npx -y @forgemeshlabs/travel-assistant-mcp
npm run build
node dist/index.js
search_travel_optionsget_airport_infocompare_routesbuild_booking_linkexplain_travel_timingThis package uses generic language for provider integrations. Tool responses may include external booking links and commission-eligible links. Booking completion happens with booking partners outside this MCP server.
FAQs
No-key travel MCP for Claude Desktop, Codex-style agents, Hermes, and other clients.
The npm package @forgemeshlabs/travel-assistant-mcp receives a total of 33 weekly downloads. As such, @forgemeshlabs/travel-assistant-mcp popularity was classified as not popular.
We found that @forgemeshlabs/travel-assistant-mcp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.