
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@syncrona/babel-preset-servicenow
Advanced tools
Babel preset for ServiceNow scoped apps (SyncroNow AI).
SyncroNow AI is the ServiceNow scoped-application toolchain behind the syncrona CLI. This package is not a sync.config.js build plugin: it is a plain Babel preset, listed last in the Babel options you pass to @syncrona/babel-plugin.
This Babel preset is meant to run absolutely last of all plugins and presets. Its purpose is to remove or refactor any code that might break ServiceNow's serverside Rhino engine. Right now it is fairly simple, but it might be enhanced in the future if more issues are discovered.
npm i -D @syncrona/babel-preset-servicenow
After the installation is completed, add it to the presets section of your Babel configuration.
The sanitizer performs various operations on code to make it safe for ServiceNow
__proto__ referencesServiceNow blocks references to __proto__ on the serverside. This is sidestepped by changing all references to __proto__ to __proto-sn__. So far all functionality has been preserved in transpiled output.
test.__proto__ = {};
becomes...
test.__proto-sn__ = {};
ServiceNow does not allow properties of objects that have the same name as keywords to be accessed directly. This is sidestepped by using the index syntax instead.
test.default;
becomes...
test["default"]
FAQs
Babel preset for ServiceNow scoped apps (SyncroNow AI).
The npm package @syncrona/babel-preset-servicenow receives a total of 3 weekly downloads. As such, @syncrona/babel-preset-servicenow popularity was classified as not popular.
We found that @syncrona/babel-preset-servicenow demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.