
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@paneui/core
Advanced tools
Pane relay client: typed HTTP + WebSocket operations against a Pane relay. Framework-free.
Typed client for the Pane relay HTTP + WebSocket API. Framework-free: no argv, no MCP, no server dependencies — just the relay protocol expressed as typed operations.
@paneui/core targets the Node.js runtime (>= 20, as declared in
package.json's engines). It is framework-free, not runtime-free.
The WebSocket transport (openStream) uses the ws
package rather than the global WebSocket. ws exposes a Node-style event API
(socket.on("message", ...), custom upgrade headers such as Authorization)
that the browser WebSocket does not, and the relay protocol relies on it.
Because of this, @paneui/core is not intended to run in a browser or other
non-Node runtime as-is.
The HTTP pane (PaneClient, registerAgent) uses the standard fetch API
and is runtime-agnostic; only openStream carries the Node constraint.
If you need a browser client, treat that as separate future work — it would
need a ws-vs-global-WebSocket abstraction rather than the unconditional
import { WebSocket } from "ws" used today.
PaneClient / PaneApiError — typed HTTP operations against a relay.openStream — WebSocket stream (replay-on-connect, then live). Node only.registerAgent — agent registration helper.artifactSchema, callbackSchema, createPaneSchema — Zod schemas.FAQs
Pane relay client: typed HTTP + WebSocket operations against a Pane relay. Framework-free.
We found that @paneui/core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.