
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@syncrona/sn-transport
Advanced tools
Shared ServiceNow transport policy for SyncroNow AI (scoped API prefix resolution and retryable status policy) used by the core CLI client and the MCP server client.
Shared ServiceNow transport policy for SyncroNow AI. This package is the single source of truth for the transport-level rules that both ServiceNow HTTP clients must agree on:
packages/core/src/snClient.ts (axios)packages/mcp-server/src/servicenowCore.ts (native fetch)The two clients remain separate implementations on purpose (a one-shot CLI vs. a long-lived MCP runtime with different retry/rate-limit needs), but the policies below were previously copy-pasted in both and were the most likely to silently drift apart.
ServiceNow scoped APIs live under api/<prefix>/…. SyncroNow AI tries a known set
of prefixes in order and remembers the one that worked.
DEFAULT_SCOPED_API_PREFIXES — defaults (x_nuvo_sinc, x_nuvo_sync).SCOPED_API_PREFIXES_ENV — the SYNCRONA_SCOPED_API_PREFIXES override var.sanitizeScopedPrefix(value) — strip unsafe characters from one prefix.parseConfiguredScopedApiPrefixes(rawEnvValue) — parse the override (comma
separated), falling back to the defaults; de-duplicated, order preserved.orderScopedApiPrefixes(configured, preferred?) — preferred/last-successful
prefixes first, then configured, de-duplicated.RETRYABLE_HTTP_STATUSES — canonical retryable status codes
(408, 425, 429, 500, 502, 503, 504).shouldRetryStatus(status) — predicate over that set.This module is intentionally pure: no I/O and no node globals. Callers read and clean the environment value themselves and pass the raw string in, and each client keeps its own runtime cache of the last successful prefix (transport state is per-process, not shared).
FAQs
Shared ServiceNow transport policy for SyncroNow AI (scoped API prefix resolution and retryable status policy) used by the core CLI client and the MCP server client.
The npm package @syncrona/sn-transport receives a total of 6 weekly downloads. As such, @syncrona/sn-transport popularity was classified as not popular.
We found that @syncrona/sn-transport demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.