
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
node-red-contrib-simplepush
Advanced tools
Simplepush node for Node-RED.
Run the following command in your Node-RED user directory - typically ~/.node-red
npm install node-red-contrib-simplepush
Requires Node.js 20 or newer and Node-RED 3 or newer.
msg.payload(required): The message of the taskmsg.topic: The topic the task is sent tomsg.title: The title of the taskmsg.attachments: Array of URLs to images, videos or other files that are downloaded and attached to the task (at most 10)msg.tag: A label the app can group or filter tasks bymsg.actions: Array of strings that will be shown as action buttons on the task. Tapping one completes the task.msg.timeout: Time in seconds after which a timeout error will be thrown and the task expires on the device. 0 (the default) means no timeout. Only used when the timeout field in the node config is blank.msg.autoCommit: true (default) completes the task as soon as an action is tapped, false shows a Submit button. Overrides the Auto commit checkbox.msg.password: The topic's password (set in the app) for encrypted tasks to a topicmsg.personalPassword: Your Personal Password (set in the app) for encrypted tasks to your own devicesmsg.apiToken: Overrides the API token from the node configValues set in the node config take precedence over message properties, except msg.autoCommit.
When actions are configured in the node there is one output per action and the message leaves through the output of the tapped action. When the actions come from msg.actions there is a single output.
msg.payload: The tapped actionmsg.taskId: Id of the task that was answeredmsg.actionSelectedAt: When the action was tappedmsg.recipient: Who answered (publicId, name)Version 2 uses the current Simplepush app and API and sends tasks instead of notifications. Flows from 1.x keep working after you enter an API token in the node config:
event becomes tag.salt is gone. Set a password for the topic in the app and enter it as Topic Password in the node config.msg.key is no longer supported. Use msg.topic.See simplepu.sh for more details.
FAQs
Simplepush wrapper for Node-RED
We found that node-red-contrib-simplepush demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.