
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@lucid-bio/cli
Advanced tools
Command-line interface for Lucid.
npm install -g @lucid-bio/cli
The CLI requires a Supabase URL and Service Role Key to interact with your Lucid instance. You can provide these via environment variables:
LUCID_SUPABASE_URL: Your Supabase project URL.LUCID_SUPABASE_SERVICE_ROLE_KEY: Your Supabase service role key.Alternatively, you can create a .env file in your current working directory.
lucid --help
List work items:
lucid work-item:list --team-id <team-id>
Create a work item:
lucid work-item:create --team-id <team-id> --user-id <user-id> --kind task --title "My Task" --body "Task description"
Upload a generated document:
lucid document:upload --team-id <team-id> --owner-id <user-id> --file ./proposal.md --file-name proposal.md --file-type text/markdown
Upload a review-time attachment and bind it to a work item:
lucid document:upload --team-id <team-id> --owner-id <user-id> --file ./review-notes.md --file-name review-notes.md --file-type text/markdown
lucid work-item:add-attachment --work-item-id <work-item-id> --document-id <document-id> --attachment-role source_data --actor <reviewer-id>
Bind an uploaded document to a work item result without changing status:
lucid work-item:set-result-document --work-item-id <work-item-id> --document-id <document-id> --actor worker:lucid-runner
Move a work item to review with an explicit uploaded result document:
lucid work-item:review --work-item-id <work-item-id> --run-id <run-id> --worker worker:lucid-runner --result-summary "Ready for review" --result-document-id <document-id>
Attach run logs alongside the uploaded result document:
lucid document:upload --team-id <team-id> --owner-id <user-id> --file ./agent.log --file-name agent.log --file-type text/plain
lucid work-item:review --work-item-id <work-item-id> --run-id <run-id> --worker worker:lucid-runner --result-summary "Ready for review" --result-document-id <document-id> --log-document-id <log-document-id>
lucid work-item:complete --work-item-id <work-item-id> --run-id <run-id> --worker worker:lucid-runner --result-summary "Completed" --result-document-id <document-id> --log-document-id <log-document-id>
Repeat a review round after feedback:
lucid work-item:refine --work-item-id <work-item-id> --actor <reviewer-id> --feedback "Please regenerate with the revised summary"
lucid work-item:claim --worker worker:lucid-runner --team-id <team-id>
lucid work-item:start --work-item-id <work-item-id> --run-id <run-id> --worker worker:lucid-runner
lucid document:upload --team-id <team-id> --owner-id <user-id> --file ./round-2.md --file-name round-2.md --file-type text/markdown
lucid document:upload --team-id <team-id> --owner-id <user-id> --file ./round-2.log --file-name round-2.log --file-type text/plain
lucid work-item:set-result-document --work-item-id <work-item-id> --document-id <document-id> --actor worker:lucid-runner
lucid work-item:review --work-item-id <work-item-id> --run-id <run-id> --worker worker:lucid-runner --result-summary "Round 2 ready for review" --result-document-id <document-id> --log-document-id <round-2-log-document-id>
FAQs
Unknown package
The npm package @lucid-bio/cli receives a total of 0 weekly downloads. As such, @lucid-bio/cli popularity was classified as not popular.
We found that @lucid-bio/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.