
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@strav/cache
Advanced tools
Strav cache layer — Cache abstraction + MemoryCache (in-process) + PostgresCache (cross-process ledger) + RedisCache (Bun.RedisClient, all data structures incl. tagged sets) + MemcachedCache (text-protocol client over Bun.connect). Atomic increments, dist
Key/value cache with TTLs for Strav 1.0. Apps inject the abstract Cache token; the provider in the container picks the concrete driver — MemoryCache for single-node dev, PostgresCache for multi-node deployments. Same dependency shape as @strav/broadcast (kernel-free core in the root, optional Postgres driver under a subpath).
import { Cache } from '@strav/cache'
@inject()
class LeadsService {
constructor(private readonly cache: Cache) {}
async trending(): Promise<Lead[]> {
return this.cache.remember('leads.trending', '5m', async () => {
return this.leads.query().orderBy('score', 'desc').limit(10).get()
})
}
}
Canonical docs live in docs/cache/README.md.
| Driver | Subpath | Notes |
|---|---|---|
| Memory | @strav/cache (root) + @strav/cache/memory | In-process. Bounded buffer; locks + tags first-class. Single-node only. |
| Postgres | @strav/cache/postgres | Cross-process backplane via three tables (strav_cache, strav_cache_locks, strav_cache_tags). Atomic increments via row locks, FK cascade keeps tag rows tight. |
The full Cache surface (get/put/forget/has/flush/add/increment/decrement/remember/rememberForever/lock/tags) ships on both drivers; the abstract base provides remember + rememberForever so every driver behaves identically there. No Redis driver yet — apps that need one write against the Cache contract (two abstract methods + the wrapper classes for locks/tags).
FAQs
Strav cache layer — Cache abstraction + MemoryCache (in-process) + PostgresCache (cross-process ledger) + RedisCache (Bun.RedisClient, all data structures incl. tagged sets) + MemcachedCache (text-protocol client over Bun.connect). Atomic increments, dist
We found that @strav/cache demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.