
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
NodeJS module automatic on-demand lazy loader(NodeJS模块自动按需懒加载器)
npm i noader
├── test
│ ├── app
│ │ └── module
│ │ └── a.js
│ ├── app2
│ │ └── b.js
│ └── index.js
module.exports = {
prop: 'prop a',
fun: function(str){
this.prop = str;
return this.prop;
}
}
module.exports = class {
constructor(str) {
this.str = str;
}
fun(str) {
this.str = str;
return this.str;
}
self() {
return this;
}
}
const noader = require('noader');
const loader = noader();
console.log(loader.app.module.a); // Object: a
console.log(loader.app.module.a.prop); // String: 'prop a'
console.log(loader.app.module.a.fun('test1')); // String: 'test1'
console.log(loader.app2.b); // Class: b
console.log(loader.app2.b === loader.app2.b); // Boolean: true
console.log(loader.app2.b.str); // Undefined
console.log(loader.app2.b.fun('test2')); // String: 'test2'
console.log(loader.app2.b.$map.instance); // Class: b instance
console.log(loader.app2.b.$map.instance === loader.app2.b.$map.instance); // Boolean: true
console.log(loader.app2.b.$map.is_class); // Boolean: true
const c = new loader.app2.b('test3');
console.log(c); // Class b instance: c
console.log(c.str); // String: 'test3'
console.log('---------------------------------');
const loader2 = noader('../', 'test4');
console.log(loader2.test.app.module.a); // Object: a
console.log(loader2.test.app2.b); // Class: b
console.log(loader2.test.app2.b.str); // String: 'test4'
console.log('---------------------------------');
console.log(loader2.test.app2.b === loader.app2.b); // Boolean: false (because the class is a proxy object)
console.log(loader2.test.app2.b.$map.instance === loader.app2.b.$map.instance); // Boolean: false
console.log(loader2.test.app2.b.$map.path); // the absoulte path of b
{ prop: 'prop a', fun: [Function: fun] }
prop a
test1
[Function]
true
undefined
test2
{ str: 'test2' }
true
true
{ str: 'test3' }
test3
---------------------------------
{ prop: 'test1', fun: [Function: fun] }
[Function]
test4
---------------------------------
false
false
D:\wwwroot\noader\test/app2/b/
npm test
FAQs
NodeJS module automatic on-demand lazy loader
We found that noader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.