
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@txkit/ows-adapter
Advanced tools
Bridge MoonPay Open Wallet Standard (OWS) and PreparedTransaction. Convert PreparedEnvelope to OWS signAndSend payloads with policy-engine annotations. _OWS signs. txKit decides what's safe to sign._
Bridge MoonPay Open Wallet Standard (OWS) and @txkit/tx-protocol. Convert PreparedEnvelope to OWS signAndSend payloads with policy-engine annotations populated.
OWS signs. txKit decides what's safe to sign.
v0.1.0-alpha - OWS is at v1.3.2; surface tracks spec evolution.
OWS standardizes key custody + signing for AI agents. The current spec (v1.3.2) reserves simulate: true and simulation?: SimulationResult on the policy interface but leaves the SimulationResult shape abstract (issue #153). This adapter populates that slot from a PreparedEnvelope.
PreparedEnvelope → toOwsSignAndSend() → OwsSignAndSendPayload → OWS sign + broadcast
↑ simulation pre-populated
Inverse direction:
OwsSignAndSendResult → annotateWithOwsResult(envelope, result) → envelope with meta.owsResult
This package does not take a runtime dep on @open-wallet-standard/core - the OWS shape is mirrored locally as a typed subset. Upgrade as the spec stabilizes.
npm install @txkit/ows-adapter@alpha @txkit/tx-protocol@alpha
import { createEvmTx } from '@txkit/tx-protocol'
import { toOwsSignAndSend } from '@txkit/ows-adapter'
const envelope = createEvmTx({
chain: 'eip155:1',
calls: [ { to: '0x...', data: '0xa9059cbb...' } ],
validity: { notAfter: Math.floor(Date.now() / 1000) + 3600 },
description: { short: 'Send 100 USDC', action: 'transfer' },
metadata: {
tokenMovements: [
{
kind: 'transfer',
token: '0xa0b8...', // USDC
from: '0x...',
to: '0x...',
amount: '0x5f5e100',
standard: 'erc20',
},
],
counterparties: [
{ role: 'recipient', address: '0x...', label: 'Alice', labelSource: 'ens' },
],
},
})
const owsPayload = toOwsSignAndSend(envelope)
// { chain, transaction: {to, data, value}, simulation: {functionName, tokenMovements, counterparties}, ... }
toOwsSignAndSend(envelope) - convert EvmTxEnvelope | EvmBatchEnvelope to OWS signAndSend payloadannotateWithOwsResult(envelope, result) - attach OWS broadcast receipt to envelope meta.owsResultSkeleton with single-call and batch translation. Roadmap:
signature envelope kind → OWS signMessage payloadpermissions fieldproducer.signature verification on the consumer sideFAQs
Bridge MoonPay Open Wallet Standard (OWS) and PreparedTransaction. Convert PreparedEnvelope to OWS signAndSend payloads with policy-engine annotations. _OWS signs. txKit decides what's safe to sign._
The npm package @txkit/ows-adapter receives a total of 1 weekly downloads. As such, @txkit/ows-adapter popularity was classified as not popular.
We found that @txkit/ows-adapter demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.