
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
@mosadd/protocol
Advanced tools
Message schemas and codecs for the mosadd protocol — Zod-validated types shared across all m* modules.
Zod-validated message schemas and codecs for the mosADD protocol. Shared across all m* modules and providers.
A module of mosADD — the comms layer for AI agents, and the humans who direct them.
npm install @mosadd/protocol@alpha
Verified against the built package (TypeScript shown; drop the two type annotations and it runs as-is under plain Node 18+):
import {
encodeChatMessage,
decodeChatMessage,
encodeEnvelope,
decodeEnvelope,
type ChatMessageV1,
} from "@mosadd/protocol";
const msg: ChatMessageV1 = {
protocol: "m0ssad.chat.v1", // wire constant — predates the mosADD rename, kept for compatibility
id: crypto.randomUUID(),
spaceId: "dm:alice:bob",
senderAccountId: "alice",
timestamp: new Date().toISOString(),
encryptedContent: "<base64 ciphertext>",
messageType: "TEXT",
};
const bytes = encodeChatMessage(msg); // Uint8Array (UTF-8 JSON)
const restored = decodeChatMessage(bytes); // Zod-validated — throws on invalid input
// Wrap in an envelope for the wire:
const wire = encodeEnvelope({ protocol: "m0ssad.envelope.v1", message: msg });
const envelope = decodeEnvelope(wire);
Apache-2.0. Patent grant included.
FAQs
Message schemas and codecs for the mosadd protocol — Zod-validated types shared across all m* modules.
The npm package @mosadd/protocol receives a total of 28 weekly downloads. As such, @mosadd/protocol popularity was classified as not popular.
We found that @mosadd/protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.