
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@glidemq/hono
Advanced tools
Hono middleware that turns glide-mq queues into a REST API with real-time SSE and type-safe RPC. One middleware + one router gives you queue operations, schedulers, flow orchestration over HTTP, rolling usage summaries, and broadcast routes.
GlideMQApiType and use Hono's hc<> for end-to-end typed HTTP calls with zero codegencreateTestApp builds an in-memory app for app.request() assertionsnpm install @glidemq/hono glide-mq hono
Optional - install zod and @hono/zod-validator for request validation.
Requires glide-mq >= 0.14.0 and Hono 4+.
import { Hono } from "hono";
import { glideMQ, glideMQApi } from "@glidemq/hono";
const app = new Hono();
app.use(
glideMQ({
connection: { addresses: [{ host: "localhost", port: 6379 }] },
queues: {
emails: {
processor: async (job) => {
await sendEmail(job.data.to, job.data.subject);
return { sent: true };
},
concurrency: 5,
},
},
}),
);
app.route("/api/queues", glideMQApi());
export default app;
glideMQ() injects a registry into c.var.glideMQ. glideMQApi() returns a typed sub-router that exposes the full queue-management HTTP surface.
import { hc } from "hono/client";
import type { GlideMQApiType } from "@glidemq/hono";
const client = hc<GlideMQApiType>("http://localhost:3000/api/queues");
const res = await client[":name"].jobs.$post({
param: { name: "emails" },
json: { name: "welcome", data: { to: "user@example.com" } },
});
const job = await res.json(); // typed as JobResponse
glide-mq is an AI-native message queue. This middleware exposes AI orchestration primitives as REST endpoints:
GET /:name/flows/:id/usage - aggregated token/cost usage across all jobs in a flowGET /:name/flows/:id/budget - budget state (limits, spent, exceeded) for a flowPOST /flows - create a tree flow or DAG over HTTP with { flow, budget? } or { dag }GET /flows/:id - inspect a flow snapshot with nodes, roots, counts, usage, and budgetGET /flows/:id/tree - inspect the nested tree view for a submitted tree flow or DAGDELETE /flows/:id - revoke or flag remaining jobs in a flow and delete the HTTP flow recordGET /:name/jobs/:id/stream - SSE stream of real-time chunks from a streaming jobGET /usage/summary - rolling per-queue or cross-queue usage summary from persisted minute bucketsPOST /broadcast/:name - publish a broadcast message with a subject, payload, and optional job optionsGET /broadcast/:name/events - SSE stream for broadcast delivery; requires subscription and optionally filters subjectsJobs returned from all endpoints include AI fields when present: usage, signals, budgetKey, fallbackIndex, tpmTokens. SSE events include usage, suspended, and budget-exceeded event types.
HTTP-submitted budgets are currently supported for tree flows only, not DAG payloads.
See the glide-mq docs for the full AI primitives API.
GlideMQConfig accepts connection, queues, producers, prefix (default "glide"), and testing (boolean). Restrict exposed queue and broadcast names via glideMQApi({ queues: ["emails"], producers: ["emails"] }).
import { createTestApp } from "@glidemq/hono/testing";
const { app, registry } = createTestApp({
emails: { processor: async (job) => ({ sent: true }) },
});
const res = await app.request("/emails/jobs", {
method: "POST",
headers: { "Content-Type": "application/json" },
body: JSON.stringify({ name: "welcome", data: { to: "user@test.com" } }),
});
await registry.closeAll();
registry.closeAll() (Hono has no lifecycle hooks)./flows*, GET /usage/summary, and broadcast routes require a live connection; they are unavailable in testing mode./^[a-zA-Z0-9_-]{1,128}$/.FAQs
Hono middleware for glide-mq - queue management REST API and SSE events
The npm package @glidemq/hono receives a total of 7 weekly downloads. As such, @glidemq/hono popularity was classified as not popular.
We found that @glidemq/hono demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.