
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
anti-default
Advanced tools
Inclusive language review for websites, docs, and code — CLI, GitHub Action, and browser extension
Anti-Default reviews copy, docs, UI strings, and live pages for colonial defaults, gendered assumptions, ableist metaphors, and documented dogwhistles. It explains what it noticed and offers clearer alternatives.
No account. No AI required for matching. Open rules you can tune.
Try the web app · Add the Chrome extension · Star on GitHub
npx anti-default .
That is the whole local setup. It prints findings and exits non-zero on clear hits. Ambiguous or quoted matches stay advisory.
To pin it in a team project:
npm install --save-dev anti-default
Want the complete project setup?
npx anti-default init
init adds an ignore file, a changed-files-only GitHub workflow, an
inclusive-check package script, and a Cursor project skill. Existing files
are never overwritten.
# Paths
npx anti-default ./src ./docs README.md
# CI formats
npx anti-default . --format json -o report.json
npx anti-default . --format sarif -o results.sarif
# Batch URLs — no Review UI
npx anti-default --urls https://example.com https://example.com/about
npx anti-default --urls-file urls.txt --format json
# Only files changed in this branch
npx anti-default . --changed-from origin/main
# Keep existing findings quiet; report only new ones
npx anti-default baseline .
Commit a .antidefaultignore so day-two noise doesn’t drown the team (example):
node_modules/
vendor/
*.min.js
rule:guys # turn off one rule for this repo
Keep inclusive language in the PR loop. This scans only changed files, fails on clear new findings, and leaves a checklist comment:
# .github/workflows/anti-default.yml
name: Anti-Default
on: [pull_request]
permissions:
contents: read
pull-requests: write
security-events: write
jobs:
scan:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
with:
fetch-depth: 0
- uses: NomadBuilder/anti-default@v1
with:
changed-from: ${{ github.event.pull_request.base.sha }}
format: json
comment-on-pr: "true"
Prefer SARIF for Code Scanning? Set format: sarif and output-file: anti-default.sarif. Full inputs: action.yml.
npx anti-default init installs .cursor/skills/anti-default/SKILL.md in the
current project. It teaches agents to run the scanner after changing
public-facing language, fix only clear findings, and ask before changing
quotations, proper names, community self-description, or contextual language.
The reusable source is in skills/anti-default/SKILL.md.
The npm package has no runtime dependencies and exposes the same analyzer used by the CLI and web app:
import { analyzeText, LANGUAGE_RULES } from "anti-default";
const result = analyzeText("Welcome, you guys.");
console.log(result.findings);
Same rules as the app — on the page you’re already looking at.
Runs offline from a bundled rule list. No tracking. No AI calls.
Dev / unpacked: npm run extension:pack → Load unpacked → extension/ · details in extension/README.md
npm install && npm run dev # localhost:3000
Every suggestion cites the style guides and references behind it → /sources
src/lib/rules.tsnpm run corpusnpm run build → out/STATIC_EXPORT=true BASE_PATH=/anti-default npm run buildProduction lives at darkai.ca/anti-default and is also vendored in DarkAI.
FAQs
Un-Default — catch racist, sexist & ableist defaults in AI and human copy (CLI, MCP, GitHub Action, extension). npm name is anti-default because un-default is blocked by an unrelated package.
The npm package anti-default receives a total of 31 weekly downloads. As such, anti-default popularity was classified as not popular.
We found that anti-default demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.