
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@savvy-web/github-action-builder
Advanced tools
A zero-config build tool for creating GitHub Actions from TypeScript. Bundles with @vercel/ncc, validates action.yml against GitHub's schema, and outputs production-ready Node.js 24 actions.
A zero-config build tool for creating GitHub Actions from TypeScript source
code. Bundles your action with @vercel/ncc,
validates action.yml against GitHub's official schema, and outputs
production-ready Node.js 24 actions.
src/main.ts, src/pre.ts,
src/post.tsaction.yml against GitHub's official
metadata specificationCreate a new GitHub Action project with a single command:
npx @savvy-web/github-action-builder init my-action
cd my-action
npm install
npm run build
That's it! Your action is built and ready. The init command generates a
complete project:
my-action/
├── src/
│ ├── main.ts # Main action entry point
│ ├── pre.ts # Pre-action hook
│ └── post.ts # Post-action cleanup
├── action.yml # GitHub Action metadata
├── action.config.ts # Build configuration
├── package.json # Dependencies and scripts
└── tsconfig.json # TypeScript configuration
Edit src/main.ts with your action logic, then rebuild with npm run build.
Your bundled action is in dist/main.js, ready to commit and use.
Create a new GitHub Action project:
npx @savvy-web/github-action-builder init my-action
Bundle all entry points into dist/:
npm run build
# or directly:
npx @savvy-web/github-action-builder build
Check your action.yml and configuration without building:
npm run validate
# or directly:
npx @savvy-web/github-action-builder validate
The builder expects this structure:
my-action/
├── src/
│ ├── main.ts # Required - main action entry point
│ ├── pre.ts # Optional - runs before main
│ └── post.ts # Optional - runs after main (cleanup)
├── action.yml # GitHub Action metadata (runs.using: "node24")
├── action.config.ts # Optional configuration
└── package.json
Customize action.config.ts for your project:
import { GitHubAction } from "@savvy-web/github-action-builder";
export default GitHubAction.create({
entries: {
main: "src/main.ts",
post: "src/cleanup.ts",
},
build: {
minify: true,
sourceMap: false,
},
});
Your action.yml must use Node.js 24:
name: "My Action"
description: "Does something useful"
runs:
using: "node24"
main: "dist/main.js"
post: "dist/post.js" # Optional
Use the builder programmatically in your scripts:
import { GitHubAction } from "@savvy-web/github-action-builder";
const action = GitHubAction.create();
const result = await action.build();
if (result.success) {
console.log(`Built ${result.build?.entries.length} entry points`);
}
action.yml with runs.using: "node24"MIT
FAQs
A zero-config build tool for creating GitHub Actions from TypeScript. Bundles with rsbuild, validates action.yml against GitHub's schema, and outputs production-ready Node.js 24 actions.
The npm package @savvy-web/github-action-builder receives a total of 291 weekly downloads. As such, @savvy-web/github-action-builder popularity was classified as not popular.
We found that @savvy-web/github-action-builder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.