
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@m2msentinel/sdk
Advanced tools
JavaScript client for M2M Sentinel Base bytecode capability, proxy and market observations
Official multi-language client library, Model Context Protocol (MCP) server, and Coinbase AgentKit ActionProvider for M2M Sentinel — deterministic EVM bytecode capability observations and common-proxy resolution for autonomous applications operating on Base. Callers own transaction policy.
Connect M2M Sentinel directly to Claude Desktop, Cursor, Windsurf, or any MCP-compliant LLM agent.
npx -y @smithery/cli mcp add M2M-Sentinel/m2m-sentinel-sdk --client claude
claude_desktop_config.json){
"mcpServers": {
"m2m-sentinel": {
"command": "npx",
"args": ["-y", "m2m-sentinel-sdk"],
"env": {
"M2M_SENTINEL_API_KEY": ""
}
}
}
}
https://api.m2msentinel.com/mcphttps://api.m2msentinel.com/sse with messages at https://api.m2msentinel.com/messagesimport { AgentKit } from "@coinbase/agentkit";
import { m2mSentinelActionProvider } from "m2m-sentinel-sdk";
const agentKit = await AgentKit.from({
walletProvider,
actionProviders: [
m2mSentinelActionProvider({
apiKey: process.env.M2M_SENTINEL_API_KEY
})
]
});
npm install m2m-sentinel-sdk
const { M2MSentinelClient } = require('m2m-sentinel-sdk');
const client = new M2MSentinelClient();
async function main() {
const audit = await client.auditContract('0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913');
console.log('Proxy Detected:', audit.audit.proxyResolution.isProxy);
console.log('Proxy Target:', audit.audit.proxyResolution.targetAddress);
console.log('Capabilities:', audit.audit.verdict.executableCapabilities);
console.log('Evidence:', audit.audit.dissection.capabilities);
}
main().catch(console.error);
wallet_sendCalls GuardThe public SDK includes guardWalletSendCalls, a customer-side execution-identity
boundary for Base Account / EIP-5792 batches. It preflights the anchor call and
evaluates its caller policy before scheduling any remaining call, then pins
remaining calls to the first trusted block identity in waves of at most four.
Each settled wave is validated and policy-checked in ascending request-index
order before a later wave starts; a failure or rejection stops later scheduling.
The original detached request is forwarded only after all checks pass. It does
not sign, broadcast, custody funds, infer inner UserOperation semantics, or
make a safety claim. See examples/base_account_paymaster_guard.js for a no-network fixture.
pip install m2m-sentinel
from m2m_sentinel import M2MSentinelClient
client = M2MSentinelClient()
audit = client.audit_contract("0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913")
print("Proxy detected:", audit["audit"]["proxyResolution"]["isProxy"])
print("Proxy target:", audit["audit"]["proxyResolution"].get("targetAddress"))
print("Capabilities:", audit["audit"]["verdict"]["executableCapabilities"])
print("Evidence:", audit["audit"]["dissection"]["capabilities"])
The public repository includes a standalone, mock-only transaction boundary
example at examples/transaction_preflight.js.
From this repository root, run:
node examples/transaction_preflight.js
It observes one caller-supplied Base transaction, passes the observation to a caller-owned policy, and reaches only a mock signing/send callback. It refuses to continue on unverified evidence, unresolved execution, an observation mismatch, or a missing Diamond selector mapping. It never signs or sends a transaction; optional live mode uses only a caller-supplied API-key header and remains the caller's responsibility.
import { x402SignerClient } from "m2m-sentinel-sdk";
const client = new x402SignerClient({
walletSigner: myAgentWallet,
baseUrl: "https://api.m2msentinel.com"
});
const result = await client.request("/v1/audit/0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913");
MIT License. Copyright (c) 2026 M2M Sentinel.
FAQs
JavaScript client for M2M Sentinel Base bytecode capability, proxy and market observations
The npm package @m2msentinel/sdk receives a total of 0 weekly downloads. As such, @m2msentinel/sdk popularity was classified as not popular.
We found that @m2msentinel/sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.