
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@syncrona/sn-transport
Advanced tools
Shared ServiceNow transport policy for SyncroNow AI (scoped API prefix resolution and retryable status policy) used by the core CLI client and the MCP server client.
Shared ServiceNow transport policy for SyncroNow AI. This package is the single source of truth for the transport-level rules that both ServiceNow HTTP clients must agree on:
packages/core/src/snClient.ts (axios)packages/mcp-server/src/servicenowCore.ts (native fetch)The two clients remain separate implementations on purpose (a one-shot CLI vs. a long-lived MCP runtime with different retry/rate-limit needs), but the policies below were previously copy-pasted in both and were the most likely to silently drift apart.
ServiceNow scoped APIs live under api/<prefix>/…. SyncroNow AI tries a known set
of prefixes in order and remembers the one that worked.
DEFAULT_SCOPED_API_PREFIXES — defaults (x_nuvo_sinc, x_nuvo_sync).SCOPED_API_PREFIXES_ENV — the SYNCRONA_SCOPED_API_PREFIXES override var.sanitizeScopedPrefix(value) — strip unsafe characters from one prefix.parseConfiguredScopedApiPrefixes(rawEnvValue) — parse the override (comma
separated), falling back to the defaults; de-duplicated, order preserved.orderScopedApiPrefixes(configured, preferred?) — preferred/last-successful
prefixes first, then configured, de-duplicated.RETRYABLE_HTTP_STATUSES — canonical retryable status codes
(408, 425, 429, 500, 502, 503, 504).shouldRetryStatus(status) — predicate over that set.This module is intentionally pure: no I/O and no node globals. Callers read and clean the environment value themselves and pass the raw string in, and each client keeps its own runtime cache of the last successful prefix (transport state is per-process, not shared).
FAQs
Shared ServiceNow transport policy for SyncroNow AI (scoped API prefix resolution and retryable status policy) used by the core CLI client and the MCP server client.
The npm package @syncrona/sn-transport receives a total of 0 weekly downloads. As such, @syncrona/sn-transport popularity was classified as not popular.
We found that @syncrona/sn-transport demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.