
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@tekton-ui/esbuild-plugin
Advanced tools
esbuild plugin for build-time token compliance validation.
Scans your codebase during build to ensure 100% token compliance. Fails the build if hardcoded CSS values are detected.
pnpm add -D @tekton/esbuild-plugin
import { build } from 'esbuild';
import { tektonPlugin } from '@tekton/esbuild-plugin';
await build({
entryPoints: ['src/index.ts'],
bundle: true,
plugins: [
tektonPlugin({
strict: true, // Fail build on violations (default: true in production)
threshold: 100, // Required compliance percentage
verbose: true, // Enable logging
reportPath: './tekton-report.txt', // Optional report file
}),
],
});
import { defineConfig } from 'tsup';
import { tektonPlugin } from '@tekton/esbuild-plugin';
export default defineConfig({
entry: ['src/index.ts'],
esbuildPlugins: [
tektonPlugin({
strict: process.env.NODE_ENV === 'production',
}),
],
});
interface TektonPluginOptions {
strict?: boolean; // Fail build on violations (default: true in prod)
include?: RegExp[]; // File patterns to include (default: /.tsx?$/)
exclude?: RegExp[]; // File patterns to exclude (default: node_modules, tests)
threshold?: number; // Compliance threshold (default: 100)
reportPath?: string; // Generate report file
verbose?: boolean; // Enable verbose logging
}
strict: false): Warns about violations but doesn't fail buildstrict: true): Fails build if any violations are found// ❌ Detected violations:
styled.div`
background: #ffffff; // Error: hex color "#ffffff"
// Suggestion: tokens.bg.* or tokens.fg.*
padding: 16px; // Error: pixel spacing "16px"
// Suggestion: tokens.spacing[4]
`;
MIT
FAQs
esbuild plugin for build-time token compliance validation
The npm package @tekton-ui/esbuild-plugin receives a total of 0 weekly downloads. As such, @tekton-ui/esbuild-plugin popularity was classified as not popular.
We found that @tekton-ui/esbuild-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.