
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@strav/broadcast
Advanced tools
Strav broadcast / pub-sub primitive — Broadcaster interface + MemoryBroadcaster (in-process) + PostgresBroadcaster (polling-ledger backplane) + per-channel authorization. Pairs with @strav/http's router.sse and @strav/notification/broadcast.
In-process and multi-node pub/sub for Strav 1.0. Powers SSE endpoints (router.sse(...) in @strav/http) and the broadcast notification channel (@strav/notification/broadcast). Apps inject the abstract Broadcaster token; the provider in the container picks the concrete driver — MemoryBroadcaster for single-node dev, PostgresBroadcaster for multi-node deployments.
import { Broadcaster } from '@strav/broadcast'
@inject()
class OrdersController {
constructor(private readonly broadcaster: Broadcaster) {}
async pay(req: Request): Promise<Response> {
const order = await this.orders.markPaid(req)
await this.broadcaster.publish(`private-orders.${order.tenantId}`, {
id: order.eventId,
event: 'order.paid',
data: { orderId: order.id, amount: order.amountCents },
})
return new Response(null, { status: 204 })
}
}
Canonical docs live in docs/broadcast/README.md.
| Driver | Subpath | Notes |
|---|---|---|
| Memory | @strav/broadcast (root) + @strav/broadcast/memory | In-process pub/sub. Single-node only. Bounded per-subscription buffer with overflow hooks. |
| Postgres | @strav/broadcast/postgres | Polling-ledger backplane (strav_broadcast_events table). Multi-node. ~250ms p50 latency at default polling interval. |
Per-channel authorization is built into the base class — register exact names or trailing-wildcard patterns ('private-orders.*') via broadcaster.authorize(pattern, fn). Channels with the private- or presence- prefix are denied by default unless an authorizer says yes.
FAQs
Strav broadcast / pub-sub primitive — Broadcaster interface + MemoryBroadcaster (in-process) + PostgresBroadcaster (polling-ledger backplane) + per-channel authorization. Pairs with @strav/http's router.sse and @strav/notification/broadcast.
We found that @strav/broadcast demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.