
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
lucentracode
Advanced tools
AI coding agent for the terminal, powered by the LucentraCode gateway.
npm install -g lucentracode
lucentracode login # opens your browser to authorise this terminal
cd my-project && lucentracode
login opens the LucentraCode dashboard,
you click Authorize, and the CLI receives its own API key. You never type or
paste a credential.
A terminal coding agent: repository exploration, grep and glob, file reads, edits and patches, shell execution, test runs, tool calling with a permission prompt, plan mode, subagents, context compaction, and MCP.
The default model is Smart Auto, which routes each request to a model chosen
for the task. lucentracode models lists the catalogue if you want to pin one.
lucentracode usage # allowance used, as a percentage
lucentracode status # account, gateway, plan
lucentracode dashboard # open the dashboard
lucentracode logout
This package contains no binary. On install npm pulls only the
lucentracode-<os>-<arch> packages matching your machine, not all twelve.
On arm64 that is one package. On x64 it is two or more: the -baseline build
exists for CPUs without AVX2, and package.json cannot express "requires AVX2" --
only os and cpu, which both x64 variants declare identically. npm therefore
fetches both and the launcher picks the right one at runtime.
The launcher needs no install scripts, including when installed with
--ignore-scripts or pnpm. Node.js 18 or newer is required to run it.
MIT. LucentraCode is a fork of OpenCode.
FAQs
AI coding agent for the terminal, powered by the LucentraCode gateway.
The npm package lucentracode receives a total of 458 weekly downloads. As such, lucentracode popularity was classified as not popular.
We found that lucentracode demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.