
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@uipath/auth
Advanced tools
Affected versions:
Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.
Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.
npm install @uipath/auth
import { interactiveLogin } from "@uipath/auth";
await interactiveLogin({ file: ".uipath" });
import { clientCredentialsLogin } from "@uipath/auth";
const tokens = await clientCredentialsLogin({
clientId: process.env.CLIENT_ID,
clientSecret: process.env.CLIENT_SECRET,
});
import { getLoginStatusAsync } from "@uipath/auth";
const status = await getLoginStatusAsync({ file: ".uipath" });
| Export | Description |
|---|---|
interactiveLogin(options) | Browser-based authorization code flow with PKCE |
clientCredentialsLogin(props) | Silent client credentials flow for service accounts |
getLoginStatusAsync(options) | Check current login status, auto-refreshes expired tokens |
refreshAccessToken() | Refresh an expired access token |
selectTenant() | Interactive tenant selection |
setAuthFileConfig(cfg) | Push the on-disk auth.* config slice into the auth singleton (called once by the CLI host at startup) |
saveEnvFileAsync() / loadEnvFileAsync() | Credential file I/O |
See the root repository for license information.
FAQs
Authentication module for the UiPath CLI. Handles OIDC login, token management, and credential storage.
The npm package @uipath/auth receives a total of 799 weekly downloads. As such, @uipath/auth popularity was classified as not popular.
We found that @uipath/auth demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 25 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.