
Research
/Security News
Malicious Chrome and Firefox Extensions Steal Crypto Traders’ Session and Wallet Data
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.
npm wrapper for the hermai CLI — turns any website into a structured JSON API for AI agents.
npm install -g hermai-cli
# or
npx hermai-cli --help
On install, the package's postinstall downloads the correct prebuilt
binary for your platform (macOS/Linux/Windows × amd64/arm64) from the
corresponding GitHub release, verifies its sha256 against the release's
checksums.txt, and places it alongside the wrapper. No cgo, no Go
toolchain required.
HERMAI_PLATFORM_KEY authenticates registry and MCP requests. You can also
run hermai registry login once to store the key in local Hermai config.HERMAI_SKIP_POSTINSTALL=1 skips the binary download at install time.
Useful in sandboxed CI where outbound network to GitHub releases is
blocked; you'll need to drop the binary at node_modules/hermai-cli/bin/hermai
yourself.Expose Hermai as tools in any MCP-capable runtime:
hermai mcp serve
Generic MCP client config:
{
"mcpServers": {
"hermai": {
"command": "hermai",
"args": ["mcp", "serve"],
"env": {
"HERMAI_PLATFORM_KEY": "hm_sk_..."
}
}
}
}
brew install hermai-ai/hermai/hermai (Homebrew, macOS/Linux)go install github.com/hermai-ai/hermai-cli/cmd/hermai@latest (Go toolchain)See docs.hermai.ai.
AGPL-3.0-or-later — same as the upstream binary.
FAQs
Turn any website into a structured JSON API for AI agents.
The npm package hermai-cli receives a total of 18 weekly downloads. As such, hermai-cli popularity was classified as not popular.
We found that hermai-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Malicious Chrome and Firefox extensions target Axiom Trade and Padre users, stealing session tokens and wallet data.

Security News
GPT-6 Astra hits 100% on ExploitBench and finds zero-days autonomously, while independent tests reveal scope violations and monitoring gaps.

Product
Socket can now send alerts and supply chain attack notifications to Microsoft Teams, with filters that route the right updates to each channel.