
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
openloop-protocol
Advanced tools
`openloop-protocol` is OpenLoop's public, dependency-light collaboration protocol package described in ADR-005. The current root API is the Hub-Edge protocol; OpenLoop's internal Agent Adapter Event Protocol remains private to OpenLoop Core.
openloop-protocol is OpenLoop's public, dependency-light collaboration
protocol package described in ADR-005. The current root API is the Hub-Edge
protocol; OpenLoop's internal Agent Adapter Event Protocol remains private to
OpenLoop Core.
This package owns only the wire-safe Team Hub ↔ Local Edge collaboration protocol:
It intentionally does not import OpenLoop Core, TeamLoop, a Hub database, HTTP server, Agent SDK, UI code, or local runner implementation.
The prerelease tarball builds src to dist/*.js and dist/*.d.ts before
packing so downstream Hub/Edge consumers can import the protocol package
without transpiling TypeScript from node_modules.
decodeHubEdgeMessage accepts unknown, validates envelope and payload values
at runtime, and returns a correlated envelope union. Consumers can narrow on
messageType without recreating wire schemas or asserting payload types.
The public payload and decoded-envelope types are inferred from the same
message definitions used by the runtime validator.
FAQs
`openloop-protocol` is OpenLoop's public, dependency-light collaboration protocol package described in ADR-005. The current root API is the Hub-Edge protocol; OpenLoop's internal Agent Adapter Event Protocol remains private to OpenLoop Core.
The npm package openloop-protocol receives a total of 0 weekly downloads. As such, openloop-protocol popularity was classified as not popular.
We found that openloop-protocol demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.