
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@rive-app/canvas-advanced-lite
Advanced tools
Low-level lite Rive API using CanvasRenderingContext2D. Please see https://rive.app/community/doc/canvas-vs-webgl/docanjXoQ1uT for a list of all the available web runtimes and their details.
npm install @rive-app/canvas-advanced-lite
A low-level Rive API using the CanvasRenderingContext2D renderer. It has the same benefits as the regular @rive-app/canvas package plus:
The complimentary @rive-app/canvas-advanced dependency supports all Rive features and contains the necessary backing dependencies to render those graphics. This lite version has the same API, but does not compile and build with certain dependencies in order to keep the package size as small as possible.
At this time, this lite version of @rive-app/canvas-advanced-lite will not render Rive Text onto the canvas or play Rive Audio. Note however, that even if your Rive file may include Rive Text components, rendering the graphic should not cause any app errors, or cease to render. The same is true for playing audio.
FAQs
Rive's lite low-level canvas based web api.
The npm package @rive-app/canvas-advanced-lite receives a total of 828 weekly downloads. As such, @rive-app/canvas-advanced-lite popularity was classified as not popular.
We found that @rive-app/canvas-advanced-lite demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.