
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@strav/herald
Advanced tools
Strav micro-publishing — provider-agnostic abstraction for publishing posts to social platforms (Google Business Profile, Meta/Facebook + Instagram, WordPress). Normalized PublishInput + capability-flagged drivers + inbound webhook registry for engagement
Provider-agnostic micro-publishing for Strav apps.
@strav/herald is the publish-side counterpart to @strav/instant (chat) and
@strav/notification (per-user delivery). It lets an app publish a post to one
or more external platforms (Google Business Profile, Facebook Page, Instagram,
WordPress, …) behind a single normalized API, then receive engagement events
(reviews, comments, reactions) back through a typed webhook registry.
Status: alpha — scaffold (skeleton + driver contract). Drivers ship in follow-up slices: WordPress first, then Meta, then GBP.
bun add @strav/herald
import { HeraldManager } from '@strav/herald'
const herald = app.resolve(HeraldManager)
const result = await herald.publish(
{ provider: 'wordpress', accountId: 'wp-tenant-42' },
{
text: "We just opened our garden patio — come by for the sunset!",
attachments: [{ type: 'image', url: 'https://cdn.example.com/patio.jpg' }],
},
)
console.log(result.providerPostId, result.url)
| Subpath | Status | Platform |
|---|---|---|
@strav/herald/wordpress | planned | WordPress REST |
@strav/herald/meta | planned | Facebook Page + Instagram (Graph API) |
@strav/herald/gbp | planned | Google Business Profile |
@strav/herald/x | future | X (Twitter) |
@strav/herald/tiktok | future | TikTok |
See docs/herald/ for setup, OAuth scopes, and webhook wiring.
FAQs
Strav micro-publishing — provider-agnostic abstraction for publishing posts to social platforms (Google Business Profile, Meta/Facebook + Instagram, WordPress). Normalized PublishInput + capability-flagged drivers + inbound webhook registry for engagement
The npm package @strav/herald receives a total of 1 weekly downloads. As such, @strav/herald popularity was classified as not popular.
We found that @strav/herald demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.