
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@mosadd/bridges
Advanced tools
Bridge modules — reach existing networks (Telegram, Discord, Matrix, Signal, WhatsApp, Slack, iMessage) from mosadd. Derived from Hermes Agent gateway/platforms/ (MIT).
Bridge Provider Pack — let mosadd users reach contacts on existing networks (Matrix, Discord, Telegram, Slack, Signal, WhatsApp, iMessage) without forcing those contacts to sign up for mosadd.
Phase 1 alpha: TypeScript interface + 3 scaffold adapters (Matrix, Discord, Telegram). Real protocol wiring lands per-bridge in follow-ups to LINEAR-2168. Adapters currently throw
BridgeNotImplementedErrorfrom their handlers — the shape is locked, the wires are not.
Every new messenger fights "but all my friends are on WhatsApp/Telegram". mosadd's OS framing turns that into a feature: add mTELEGRAM and the user can reach Telegram contacts from a single mosadd MCP call — no fork in their network.
This package is design-adopted from the Hermes Agent (MIT, Nous Research) gateway/platforms/ pattern. See the project NOTICE for full attribution.
import { getBridge, type BridgeProvider } from "@mosadd/bridges";
const matrix: BridgeProvider = getBridge("matrix");
await matrix.verifyConfig({ homeserver: "...", access_token: "...", user_id: "@bot:..." });
await matrix.sendMessage(config, { to: "!roomId:server", text: "hi from mosadd" });
BridgeProvider is uniform across networks — every bridge implements verifyConfig, sendMessage, listMessages, and resolveHandle. Network-specific config shape (token, session, homeserver, …) is validated inside each adapter.
| Bridge | Status | Upstream license | Notes |
|---|---|---|---|
MatrixBridge | scaffold | Apache-2.0 (matrix-bot-sdk planned) | First-class — federation reaches the whole Matrix network with one bot account |
DiscordBridge | scaffold | MIT (discord.js / discord-api-types planned) | Bot token, channel + DM scope |
TelegramBridge | scaffold | MIT (telegraf / gram.js planned) | Two modes — Bot API and MTProto user session |
Coming next (per LINEAR-2168):
SlackBridge — workspace bots (Phase 1 P1)SignalBridge — linked device, signal-cli-rest-api (Phase 1 P1)WhatsAppBridge — Business Cloud API (Phase 2, legal review)iMessageBridge — Mac-only via Blue Bubbles or BlueBubbles-Server (Phase 2, legal review)Every bridge takes a network-specific config object — see each adapter's TypeScript types for the exact shape. Adapters validate eagerly: verifyConfig({}) throws with an actionable error.
Env-var convention (for the MCP server to surface):
| Bridge | Env vars |
|---|---|
| Matrix | M0SSAD_MATRIX_HOMESERVER, M0SSAD_MATRIX_ACCESS_TOKEN, M0SSAD_MATRIX_USER_ID |
| Discord | M0SSAD_DISCORD_TOKEN, M0SSAD_DISCORD_GUILD (optional) |
| Telegram (bot) | M0SSAD_TELEGRAM_BOT_TOKEN |
| Telegram (user) | M0SSAD_TELEGRAM_API_ID, M0SSAD_TELEGRAM_API_HASH, M0SSAD_TELEGRAM_SESSION |
BridgeProvider interface in packages/bridges/src/<network>/index.ts.bridges registry in packages/bridges/src/index.ts.packages/mcp/src/tools/<network>.ts (see how mIRC does it — straight pattern to copy).skills/<network>/SKILL.md.FAQs
EXPERIMENTAL scaffold (not functional yet) — bridge adapter interfaces (Matrix/Discord/Telegram) intended to reach existing networks from mosadd. Every method currently throws BridgeNotImplementedError until real protocol wiring lands. Not for production.
The npm package @mosadd/bridges receives a total of 3 weekly downloads. As such, @mosadd/bridges popularity was classified as not popular.
We found that @mosadd/bridges demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.