
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@pulsemcp/air-core
Advanced tools
AIR core — config resolution, validation, schemas, and extension interfaces
Core package for the AIR framework. Provides config resolution, validation, JSON schemas, and extension interfaces.
npm install @pulsemcp/air-core
import {
resolveArtifacts,
validateJson,
mergeArtifacts,
emptyArtifacts,
} from "@pulsemcp/air-core";
// Resolve all artifacts from an air.json file
const artifacts = await resolveArtifacts("~/.air/air.json");
// Validate a JSON file against its AIR schema
const result = validateJson(data, "skills");
// Merge two artifact sets (additive union — duplicate qualified IDs throw)
const merged = mergeArtifacts(base, overlay);
import { resolveArtifacts } from "@pulsemcp/air-core";
import { GitHubCatalogProvider } from "@pulsemcp/air-provider-github";
const artifacts = await resolveArtifacts("./air.json", {
providers: [new GitHubCatalogProvider()],
});
resolveArtifacts(), loadAirConfig(), mergeArtifacts(), emptyArtifacts()validateJson() using AJV against AIR JSON SchemasloadSchema(), detectSchemaType(), detectSchemaFromValue()SkillEntry, McpServerEntry, RootEntry, ReferenceEntry, PluginEntry, HookEntryAgentAdapter, CatalogProvider, PrepareTransform, AirExtensionAgentSessionConfig, StartCommand, PrepareSessionOptions, PreparedSessionCore defines four extension points that other packages implement:
| Interface | Purpose | Example |
|---|---|---|
AgentAdapter | Translate AIR config for a specific agent | @pulsemcp/air-adapter-claude |
CatalogProvider | Resolve remote URIs in air.json | @pulsemcp/air-provider-github |
PrepareTransform | Post-prepare transforms on .mcp.json | @pulsemcp/air-secrets-env, @pulsemcp/air-secrets-file |
AirExtension | Extension metadata for CLI discovery | All extension packages |
FAQs
AIR core — config resolution, validation, schemas, and extension interfaces
The npm package @pulsemcp/air-core receives a total of 22 weekly downloads. As such, @pulsemcp/air-core popularity was classified as not popular.
We found that @pulsemcp/air-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.