
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
@zachleat/snow-fall
Advanced tools
A web component to add snow to your web site (or to an element on your web site).
<snow-fall>A web component to add snow to your web site (or to an element on your web site). Based off of this Codepen from alphardex.
<script type="module" src="snow-fall.js"></script>
<!-- Add snow to the page -->
<snow-fall></snow-fall>
<!-- Add snow to the first child element -->
<snow-fall>
<div style="width: 300px; height: 300px">
</snow-fall>
Installable from npm:
npm install @zachleat/snow-fall
<is-land>This is best used with <is-land> to respect user preferences for reduced motion:
<is-land on:media="(prefers-reduced-motion: no-preference)">
<snow-fall></snow-fall>
</is-land>
<!-- Change snow color -->
<snow-fall style="--snow-fall-color: rebeccapurple"></snow-fall>
<!-- Default: 100 -->
<snow-fall count="200"></snow-fall>
Added in v1.0.2
<!-- Default: 10px -->
<snow-fall style="--snow-fall-size: 20px"></snow-fall>
You probably don’t need this.
<snow-fall mode="page"></snow-fall>
<snow-fall mode="element"></snow-fall>
FAQs
A web component to add snow to your web site (or to an element on your web site).
The npm package @zachleat/snow-fall receives a total of 113 weekly downloads. As such, @zachleat/snow-fall popularity was classified as not popular.
We found that @zachleat/snow-fall demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.