
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@tencent-weixin/openclaw-weixin-cli
Advanced tools
Lightweight installer for the OpenClaw Weixin channel plugin
OpenClaw 微信消息通道插件的统一安装器。自动检测宿主 OpenClaw 版本,安装兼容的插件版本。
npx -y @tencent-weixin/openclaw-weixin-cli install
安装器会自动完成以下步骤:
openclaw --versionopenclaw plugins install 安装对应版本无需手动指定版本号。
| openclaw-weixin | 支持的 OpenClaw | dist-tag | 说明 |
|---|---|---|---|
| 1.0.x | >=2026.3.0 <2026.3.22 | compat-host-gte2026.3.0-lt2026.3.22 | 兼容轨道 |
| v2 主线 | >=2026.3.22 | latest | 当前推荐 |
从 2.0.0 开始,插件采用独立 semver 版本号,不再对齐宿主 OpenClaw 版本号。
如果需要手动指定版本,可以直接使用 openclaw 命令:
# 查看当前 OpenClaw 版本
openclaw --version
# 当前推荐主线 (>=2026.3.22)
openclaw plugins install @tencent/openclaw-weixin@latest
# 兼容轨道 (<2026.3.22)
openclaw plugins install @tencent/openclaw-weixin@compat-host-gte2026.3.0-lt2026.3.22
插件在启动时会自动检查宿主版本兼容性。如果版本不匹配,将立即抛出错误:
[openclaw-weixin] 宿主版本不兼容!
当前 OpenClaw 版本: 2026.3.10
当前插件支持范围: >=2026.3.22
请安装 openclaw-weixin@compat-host-gte2026.3.0-lt2026.3.22
或运行: npx @tencent-weixin/openclaw-weixin-cli install (自动选择兼容版本)
症状:插件启动时报 宿主版本不兼容 错误。
解决:
# 1. 确认 OpenClaw 版本
openclaw --version
# 2. 用统一安装器重新安装(自动匹配版本)
npx -y @tencent-weixin/openclaw-weixin-cli install
openclaw --version
本仓库发布的是 CLI 安装器(openclaw-weixin-cli),不是插件本身(openclaw-weixin)。
COMPAT_MATRIX 自动选择正确的插件 dist-tag 来安装FAQs
Lightweight installer for the OpenClaw Weixin channel plugin
The npm package @tencent-weixin/openclaw-weixin-cli receives a total of 1,811 weekly downloads. As such, @tencent-weixin/openclaw-weixin-cli popularity was classified as popular.
We found that @tencent-weixin/openclaw-weixin-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.