
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@toa.io/pointer
Advanced tools
The Pointer is a mechanism to deploy and resolve at runtime a set of URLs. Used by connectors and extensions.
The Pointer annotation is an object whose keys are arbitrary dot-separated strings. The meaning of these keys are defined in the corresponding module that unilizes the Poiner.
The values of the annotation object must be a URL or a list of URLs without credentials.
something:
one: amqp://all-dummies.rmq.example.com
two:
- amqp://rmq0.example.com
- amqp://rmq1.example.com
If the Pointer annotation is a string, then its value is considered as default (.).
mongodb: mongo://default.db.example.com
Pointer values can contain shards syntax.
something:
one: redis://redis{0-2}.example.com
default namespaceWhen the Pointer is used for component-specific URLs and the component is in the default
namespace (that is, no namepsace is specified in its manifest), the annotation value must
explicitly contain the default namespace.
amqp:
# value for the `default` namespace
default: amqp://default-ns.rmq.example.com
# value for `teapots` component of the `default` namespace
default.teapots: amqp://default-dummy.rmq.example.com
Although the most common use case of the Pointer is component-specific connection strings, where the keys are namespaces or component IDs, it is not mandatory. The Pointer considers keys as nested dot-separated alphanumeric strings.
A module that uses the Pointer, resolves a set of URLs by providing annotation and a set of
selectors during deployment.
The resolution finds the deepest match for a given dot-separated string within the annotation,
falling back to the default URL (. key) if no matches are found.
# context.toa.yaml
amqp:
.: amqp://default.rmq.example.com # default URL
dummies: amqp://all-dummies.rmq.example.com # default URL for the `dummies` namespace
dummies.dummy: amqp://dummies1.rmq.example.com # URL for the `dummies.dummy` component
URL resolution for the example above is as follows:
| Selector | Result | Description |
|---|---|---|
dummies.dummy | amqp://d1.rmq.example.com | Exact match |
dummies.another | amqp://all-dummies.rmq.example.com | Partial match |
what.ever | amqp://default.rmq.example.com | No match (default) |
For security reasons, URL credentials cannot be specified in the annotation; they must be deployed secretly.
Secret names must match the annotation keys with dots replaced by dashes and prefixed by an identifier provided by the corresponding connector or extension using the Pointer.
Given the AMQP binding
providing amqp-context Pointer identifier and the follwing annotation:
# context.toa.yaml
amqp:
context:
.: amqp://default.rmq.example.com
dummies: amqp://dummies.rmq.example.com
dummies.dummy: amqp://dummy.rmq.example.com
Secret names for the specified keys are as follows:
amqp-context.defaultamqp-context-dummiesamqp-context-dummies-dummyIf secrets are not deployed with the
toa conceal, then their names must be prefixed withtoa-.
Only one secret can be deployed per annotation key. Therefore, when using a URL set, all URLs will utilize the same credentials.
Secret's value for plain authentication must contain username and password keys.
$ toa conceal amqp-context-dummies-dummy username=developer password=secret
Not implemented. #367
import { createVariables } from '@toa.io/pointer'
// ...
const variables = createVariables(id, annotation, requests)
id is a Pointer identifier, annotation the Pointer annotation value, and requests is an array
of objects conforming to the following:
# label of the component
label: string
# list of the annotation keys to be deployed for the component
selectors: string[]
// runtime
import { resolve } from '@toa.io/pointer'
// resolve a set of URLs with credentials
// for a given pointer identifier and a selector
const urls = resolve(id, locator.id)
FAQs
Toa Pointer
The npm package @toa.io/pointer receives a total of 692 weekly downloads. As such, @toa.io/pointer popularity was classified as not popular.
We found that @toa.io/pointer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.