
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
getfilepress
Advanced tools
FilePress — file-based Markdown blog engine. Link this package from a content-only site (config + posts), then run `filepress build`.
Markdown blogs from git. No CMS. No database. A static build/ folder.
Written FilePress. npm getfilepress. CLI filepress (same script as getfilepress).
Site: getfilepress.com · Docs: getfilepress.com/docs
Shortest path: three files in an empty folder.
package.json:
{
"type": "module",
"scripts": {
"dev": "filepress dev",
"build": "filepress build",
"preview": "filepress preview"
},
"devDependencies": { "getfilepress": "^0.1.37" }
}
filepress.config.ts (title and url are required):
import { defineFilepressConfig } from 'getfilepress';
export default defineFilepressConfig({
title: 'My Blog',
url: 'https://my.blog',
logo: null
});
posts/2026-09-10-hello.md (title and date are required):
---
title: Hello
date: 2026-09-10
---
First post.
Then:
pnpm install
pnpm build # → ./build/
pnpm preview # serve build/ at http://127.0.0.1:27777, no Genie
logo: null gives a text title. Without it, the masthead links /logo.png and the build fails until static/logo.png exists.
pnpm dev is optional (Genie). FilePress does not upload build/.
From a clone of this repo, scaffold a fuller starter:
pnpm install
pnpm create-site my-blog --external ../my-blog --title "My Blog" --url https://my.blog
cd ../my-blog && pnpm install && pnpm dev
filepress new "Title" stamps posts/YYYY-MM-DD-slug.md. Config, frontmatter, images, and commands: Docs.
Pin CI on npm (getfilepress current is 0.1.37) or a git SHA / existing tag. link: is local only.
pnpm filepress import --source https://example.com --yes
pnpm filepress import --source https://example.com --dry-run --no-llm
Crawls a public site (sitemap/RSS preferred) into a sibling content tree. Optional --inspire URLs (up to three) and Ollama. --no-llm stays deterministic. Import · spec.
| Topic | Where |
|---|---|
| Scaffold, config, posts | Docs · getting started |
| Theme tokens and presets | docs/THEME.md |
| Genie (dev only) | Genie · spec |
| Deploy | Deploy · docs/DEPLOY.md |
| Sibling / external sites | docs/EXTERNAL_SITES.md |
| Local ports | docs/LOCALSLIP.md |
| Agent skill page | Skill page · docs/SKILL_PAGE.md |
sites/demo — engine fixture (drafts, scheduled posts, image convention)sites/getfilepress — getfilepress.compnpm install
pnpm test
pnpm dev # demo
pnpm dev:www # product site
pnpm ship # build getfilepress + Wrangler Pages
No admin UI. No visitor comments — permanent. Genie is filepress dev only; preview and build/ do not include it. Production is files.
MIT. Copyright Catalyst Forge LLC.
FAQs
FilePress — file-based Markdown blog engine. Link this package from a content-only site (config + posts), then run `filepress build`.
The npm package getfilepress receives a total of 0 weekly downloads. As such, getfilepress popularity was classified as not popular.
We found that getfilepress demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.