
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
@undisk-mcp/webhook-client
Advanced tools
Webhook signature verification SDK for Undisk MCP — verify HMAC-SHA256 signed webhook payloads
Verify HMAC-SHA256 signed webhook payloads from Undisk MCP workspaces. Analogous to Stripe's constructEvent.
npm install @undisk-mcp/webhook-client
import { verifyWebhookSignature, parseWebhookPayload } from "@undisk-mcp/webhook-client";
const isValid = await verifyWebhookSignature(
body,
request.headers.get("X-Undisk-Signature")!,
process.env.WEBHOOK_SECRET!,
);
if (isValid) {
const event = parseWebhookPayload(body);
console.log(event.event, event.data);
}
See mcp.undisk.app for full documentation.
MIT
FAQs
Webhook signature verification SDK for Undisk MCP — verify HMAC-SHA256 signed webhook payloads
We found that @undisk-mcp/webhook-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.