
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@microsoft/agents-hosting-storage-blob
Advanced tools
Microsoft 365 Agents SDK State Blob Storage support.
This package allows to configure Azure Blob Storage as the backend for Agents conversation State
const blobStorage = new BlobStorage(process.env.BLOB_STORAGE_CONNECTION_STRING!, process.env.BLOB_CONTAINER_ID!)
const conversationState = new ConversationState(blobStorage)
const userState = new UserState(blobStorage)
note: you must assign RBAC permissions to your storage account
const echo = new AgentApplication<TurnState>({
storage: new BlobsStorage('', undefined, undefined,
'https://agentsstate.blob.core.windows.net/nodejs-conversations',
new MsalTokenCredential(loadAuthConfigFromEnv()))
})
FAQs
Microsoft 365 Agents SDK State Blob Storage support.
The npm package @microsoft/agents-hosting-storage-blob receives a total of 571 weekly downloads. As such, @microsoft/agents-hosting-storage-blob popularity was classified as not popular.
We found that @microsoft/agents-hosting-storage-blob demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.