
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@virtuoso.dev/reactive-engine-core
Advanced tools
Framework-agnostic reactive state engine built on a graph of typed nodes.
@virtuoso.dev/reactive-engine-core is a framework-agnostic reactive state engine. State is modeled as a graph of typed nodes — stateful cells, stateless streams, and valueless triggers — connected through operators and combinators. An Engine instance activates the graph, propagates values, and manages subscriptions.
The package is part of the Reactive Engine family:
@virtuoso.dev/reactive-engine-react - React bindings (provider and hooks)@virtuoso.dev/reactive-engine-query - data fetching with queries and mutations@virtuoso.dev/reactive-engine-router - routing with routes, layouts, and guards@virtuoso.dev/reactive-engine-storage - cell persistence in local/session storage or cookiesnpm install @virtuoso.dev/reactive-engine-core
import { Cell, Engine } from '@virtuoso.dev/reactive-engine-core'
const count$ = Cell(0)
const engine = new Engine()
engine.sub(count$, (value) => {
console.log('count is now', value)
})
engine.pub(count$, 1)
engine.getValue(count$) // 1
map, filter, scan, debounceTime, throttleTime, withLatestFrom, and more) transform values as they flow between nodes.link, pipe, combine, merge) wire nodes into a graph.Diagnostics provide structured records of node evaluations, projection attempts, distinct-value suppression, pruning, forwarding between parent and child engines, and propagation errors. Recording is inactive until an engine observer is registered.
import { Cell, describeNode, Engine } from '@virtuoso.dev/reactive-engine-core'
const count$ = Cell(0)
describeNode(count$, { label: 'count' })
const engine = new Engine()
const stop = engine.observeDiagnostics(
(cycle) => {
sendToTelemetry(cycle)
},
{
captureValues: 'summary',
redact: (value, context) => (context.node.label === 'count' ? '[redacted]' : value),
}
)
engine.pub(count$, 1)
stop()
Observers run after the outer synchronous publication finishes. Observer failures do not change application propagation. Value capture defaults to none. In summary mode, values are converted to bounded JSON-safe snapshots before the optional redactor receives them. A node-specific summarize function registered through describeNode receives the live value, so it must not mutate it or cause application side effects.
Diagnostics record only synchronous transaction relationships. Publications from a later microtask or timer start a new transaction. The API intentionally does not retain history; consumers decide whether and where to store records.
MIT
FAQs
Framework-agnostic reactive state engine built on a graph of typed nodes.
The npm package @virtuoso.dev/reactive-engine-core receives a total of 0 weekly downloads. As such, @virtuoso.dev/reactive-engine-core popularity was classified as not popular.
We found that @virtuoso.dev/reactive-engine-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.