
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@mercuryworkshop/bare-mux
Advanced tools
**this is deprecated and will no longer be recieving updates, please use [proxy-transports](https://github.com/MercuryWorkshop/proxy-transports) instead**
this is deprecated and will no longer be recieving updates, please use proxy-transports instead
A system for managing http transports in a project such as Ultraviolet and Scramjet.
Written to make the job of creating new standards for transporting http data seamless.
Implements the TompHTTP Bare client interface in a modular way.
Specifically, this is what allows proxies such as Nebula to switch HTTP transports seamlessly.
A transport is a module that implements the BareTransport interface.
export interface BareTransport {
init: () => Promise<void>;
ready: boolean;
connect: (
url: URL,
protocols: string[],
requestHeaders: BareHeaders,
onopen: (protocol: string) => void,
onmessage: (data: Blob | ArrayBuffer | string) => void,
onclose: (code: number, reason: string) => void,
onerror: (error: string) => void,
) => [( (data: Blob | ArrayBuffer | string) => void, (code: number, reason: string) => void )] => void;
request: (
remote: URL,
method: string,
body: BodyInit | null,
headers: BareHeaders,
signal: AbortSignal | undefined
) => Promise<TransferrableResponse>;
meta: () => BareMeta
}
A guide to making a transport can be found here.
A guide for updating from v1 to v2 can be found here.
Starting from v2, bare-mux uses SharedWorkers to provide stability and improve on resource usage.
If you operate using an older bare-mux, we encourage you to update.
If you're too lazy to do either of the above, you can install an outdated and unsupported version of bare-mux.
npm install @mercuryworkshop/bare-mux@1
Examples of transports include EpoxyTransport, CurlTransport, and Bare-Client.
Here is an example of using bare-mux:
/// As an end-user
import { BareMuxConnection } from "@mercuryworkshop/bare-mux";
const conn = new BareMuxConnection("/bare-mux/worker.js");
// Set Bare-Client transport
await conn.setTransport("/path/to/transport/index.mjs", ["arg1", { wisp: "wss://wisp.mercurywork.shop" }, "arg3"]);
// Epoxy Client as an example
await conn.setTransport("/epoxy/index.mjs", [{ wisp: "wss://wisp.mercurywork.shop/" }]);
/// As a proxy developer
import { BareClient } from "@mercuryworkshop/bare-mux";
const client = new BareClient();
// Fetch
const resp = await client.fetch("https://example.com");
// Create websocket
const ws = client.createWebSocket("wss://echo.websocket.events");
FAQs
**this is deprecated and will no longer be recieving updates, please use [proxy-transports](https://github.com/MercuryWorkshop/proxy-transports) instead**
The npm package @mercuryworkshop/bare-mux receives a total of 2,960 weekly downloads. As such, @mercuryworkshop/bare-mux popularity was classified as popular.
We found that @mercuryworkshop/bare-mux demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.