
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@mosadd/bridges
Advanced tools
Bridge modules — reach existing networks (Telegram, Discord, Matrix, Signal, WhatsApp, Slack, iMessage) from mosadd. Derived from Hermes Agent gateway/platforms/ (MIT).
Bridge Provider Pack — let mosadd users reach contacts on existing networks (Matrix, Discord, Telegram, Slack, Signal, WhatsApp, iMessage) without forcing those contacts to sign up for mosadd.
Phase 1 alpha: TypeScript interface + 3 scaffold adapters (Matrix, Discord, Telegram). Real protocol wiring lands per-bridge in follow-ups to LINEAR-2168. Adapters currently throw
BridgeNotImplementedErrorfrom their handlers — the shape is locked, the wires are not.
Every new messenger fights "but all my friends are on WhatsApp/Telegram". mosadd's OS framing turns that into a feature: add mTELEGRAM and the user can reach Telegram contacts from a single mosadd MCP call — no fork in their network.
This package is design-adopted from the Hermes Agent (MIT, Nous Research) gateway/platforms/ pattern. See the project NOTICE for full attribution.
import { getBridge, type BridgeProvider } from "@mosadd/bridges";
const matrix: BridgeProvider = getBridge("matrix");
await matrix.verifyConfig({ homeserver: "...", access_token: "...", user_id: "@bot:..." });
await matrix.sendMessage(config, { to: "!roomId:server", text: "hi from mosadd" });
BridgeProvider is uniform across networks — every bridge implements verifyConfig, sendMessage, listMessages, and resolveHandle. Network-specific config shape (token, session, homeserver, …) is validated inside each adapter.
| Bridge | Status | Upstream license | Notes |
|---|---|---|---|
MatrixBridge | scaffold | Apache-2.0 (matrix-bot-sdk planned) | First-class — federation reaches the whole Matrix network with one bot account |
DiscordBridge | scaffold | MIT (discord.js / discord-api-types planned) | Bot token, channel + DM scope |
TelegramBridge | scaffold | MIT (telegraf / gram.js planned) | Two modes — Bot API and MTProto user session |
Coming next (per LINEAR-2168):
SlackBridge — workspace bots (Phase 1 P1)SignalBridge — linked device, signal-cli-rest-api (Phase 1 P1)WhatsAppBridge — Business Cloud API (Phase 2, legal review)iMessageBridge — Mac-only via Blue Bubbles or BlueBubbles-Server (Phase 2, legal review)Every bridge takes a network-specific config object — see each adapter's TypeScript types for the exact shape. Adapters validate eagerly: verifyConfig({}) throws with an actionable error.
Env-var convention (for the MCP server to surface):
| Bridge | Env vars |
|---|---|
| Matrix | MOSADD_MATRIX_HOMESERVER, MOSADD_MATRIX_ACCESS_TOKEN, MOSADD_MATRIX_USER_ID |
| Discord | MOSADD_DISCORD_TOKEN, MOSADD_DISCORD_GUILD (optional) |
| Telegram (bot) | MOSADD_TELEGRAM_BOT_TOKEN |
| Telegram (user) | MOSADD_TELEGRAM_API_ID, MOSADD_TELEGRAM_API_HASH, MOSADD_TELEGRAM_SESSION |
BridgeProvider interface in packages/bridges/src/<network>/index.ts.bridges registry in packages/bridges/src/index.ts.packages/mcp/src/tools/<network>.ts (see how mIRC does it — straight pattern to copy).skills/<network>/SKILL.md.FAQs
EXPERIMENTAL scaffold (not functional yet) — bridge adapter interfaces (Matrix/Discord/Telegram) intended to reach existing networks from mosadd. Every method currently throws BridgeNotImplementedError until real protocol wiring lands. Not for production.
The npm package @mosadd/bridges receives a total of 3 weekly downloads. As such, @mosadd/bridges popularity was classified as not popular.
We found that @mosadd/bridges demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.