
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@spiderbrain/create
Advanced tools
Give a repo a committed deterministic context layer: fetch your scored brain and write a source-free .spiderbrain/ folder + AGENTS.md block. For CI and the terminal.
Give a repo its committed SpiderBrain understanding layer. Fetches your scored brain from
the SpiderBrain API and writes a source-free .spiderbrain/ folder plus an AGENTS.md
block, so any AI coding agent that later touches the repo reads it with zero setup.
This is the produce side. To read a committed folder, see
@spiderbrain/read. Most people use the
spiderbrain umbrella command instead of
either directly.
export SPIDERBRAIN_API_KEY=sb_live_... # get one at https://spiderbrain.ai/dashboard?tab=keys
npx @spiderbrain/create --brain my-project
Writes .spiderbrain/ and merges a SpiderBrain block into AGENTS.md. Commit both.
spiderbrain-create [--brain <name|id>] [--root .] [--private] [--agents AGENTS.md]
--brain — which cloud brain to use (default: the only one on your account).--root — the repo directory to write into (default: current directory).--private — include the weighted scores. For a PRIVATE in-repo brain only; a public
brain must never carry them.--agents — the agent context file to merge into (default AGENTS.md).A source-free understanding set, documented in the
format spec: manifest.json,
structure.ndjson, and an AGENTS.block.md merged into your AGENTS.md. The public
variant contains file paths, structure, and an edge-derivable blast radius only, never your
source and never the scoring weights.
MIT.
FAQs
Give a repo a committed deterministic context layer: fetch your scored brain and write a source-free .spiderbrain/ folder + AGENTS.md block. For CI and the terminal.
We found that @spiderbrain/create demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.