
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
previewdrop
Advanced tools
CLI for PreviewDrop — live preview environments for every branch. Any Dockerfile, any stack.
A live URL for every branch. Any app, any stack.
Command-line companion to previewdrop.dev — isolated preview environments for every branch you push. Point PreviewDrop at a Dockerfile (Django, Rails, Laravel, FastAPI, Next.js, Go, Rust — anything) and get a shareable HTTPS URL in under 60 seconds. Open a PR and the URL lands as a bot comment. Merge the PR and the preview cleans itself up.
This CLI lets you trigger deploys, watch builds, tail logs, and destroy previews straight from your terminal — or wire it into CI/CD.
# Global
npm install -g previewdrop
# Or run ad-hoc
npx previewdrop <command>
Requires Node.js 18+
You need a PreviewDrop account and at least one connected repo. Sign up free at previewdrop.dev and install the GitHub App — takes under a minute. Then:
# 1. Authenticate the CLI (opens your browser)
previewdrop login
# 2. Find your project ID
previewdrop list projects
# 3. Deploy any branch and wait for a live URL
previewdrop deploy <project-id> --branch feat/new-ui --wait
You'll see something like:
✓ Deployment started: a1b2c3d4-e5f6-7890-abcd-ef1234567890
Preview URL: https://prv-a8c2f9.previews.previewdrop.dev
⠼ Status: building…
✓ Deployment ready!
https://prv-a8c2f9.previews.previewdrop.dev
That URL is a full isolated environment. Share it with designers, PMs, QA, or clients — no VPN, no staging contention, no localhost tunneling.
login — authenticatepreviewdrop login [--key <api-key>] [--host <url>]
Opens your browser to generate an API key and stores it locally (under ~/.config/previewdrop). For CI, pass a token directly:
previewdrop login --key $PREVIEWDROP_API_KEY
list — discover projects and deploymentspreviewdrop list projects
previewdrop list deployments <project-id> [--limit <n>]
deploy — trigger a previewpreviewdrop deploy <project-id> [--branch <branch>] [--wait]
--branch — any branch name (defaults to the project's configured default branch)--wait — block until the deployment reaches a terminal state. Exits 0 on ready, 1 on failed/stopped/expired. Makes this safe to drop into CI.status — inspect a deploymentpreviewdrop status <deployment-id> [--watch]
Possible states: queued · building · deploying · ready · failed · stopped · expired.
--watch polls until a terminal state is reached, showing the live status inline.
logs — build + runtime logspreviewdrop logs <deployment-id> # build log (nixpacks / Dockerfile output)
previewdrop logs <deployment-id> --runtime # container stdout/stderr
previewdrop logs <deployment-id> --runtime --tail 500
Build logs include auto-detected diagnostics for common failures (missing env vars, lockfile conflicts, port binding issues, unsupported runtimes). Runtime logs are colour-coded by severity so errors jump off the page.
destroy — tear down a previewpreviewdrop destroy <deployment-id> [--yes]
Stops the container and marks the deployment as stopped. --yes skips the confirmation prompt for scripts.
mcp — MCP server for AI agentspreviewdrop mcp [--host <url>]
Starts a Model Context Protocol server over stdio, exposing all PreviewDrop operations as tools that Claude, Cursor, and any MCP-compatible AI agent can call.
Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:
{
"mcpServers": {
"previewdrop": {
"command": "npx",
"args": ["previewdrop", "mcp"],
"env": { "PREVIEWDROP_API_KEY": "pd_live_xxx" }
}
}
}
Cursor — open Settings → MCP and add the same config block.
Available tools: get_account · list_projects · list_deployments · get_deployment · deploy (with optional wait) · redeploy · destroy_deployment · get_build_logs · get_runtime_logs · create_project · get_github_app_install_url
First-time setup with a new repo — if the repo isn't in PreviewDrop yet, just ask:
You: Preview the acme/payments-api repo on branch feature/stripe.
AI: [calls create_project — githubRepo: acme/payments-api]
Project created! ID: proj_f4e2a1c
[calls deploy — projectId: proj_f4e2a1c, branch: feature/stripe, wait: true]
Preview is live: https://prv-9a3c7f1.previews.previewdrop.dev
If the GitHub App isn't installed yet, the AI calls get_github_app_install_url automatically and gives you the direct link.
See the full MCP docs for details.
The primary reason the CLI exists. Every preview gets a unique HTTPS URL, so your pipeline can post it to Slack, attach it to a GitHub PR comment, or feed it into Playwright / Cypress for end-to-end tests against a real environment.
name: Deploy preview
on: pull_request
jobs:
preview:
runs-on: ubuntu-latest
steps:
- uses: actions/setup-node@v4
with: { node-version: 20 }
- run: npm install -g previewdrop
- run: previewdrop login --key ${{ secrets.PREVIEWDROP_API_KEY }}
- name: Deploy branch
run: previewdrop deploy ${{ secrets.PROJECT_ID }} --branch ${{ github.head_ref }} --wait
PreviewDrop already posts a bot comment + commit status check when the GitHub App sees the PR — this Action is for cases where you need the URL inside another job (e.g. for E2E tests), or where you run CI on a different platform.
The CLI is a plain Node binary with a well-defined exit code, so it drops into any CI. Store PREVIEWDROP_API_KEY as a secret and run:
npm install -g previewdrop
previewdrop login --key "$PREVIEWDROP_API_KEY"
previewdrop deploy "$PROJECT_ID" --branch "$BRANCH_NAME" --wait
Exit 0 = ready · Exit 1 = failed/stopped/expired.
Anything PreviewDrop's build layer can auto-detect or containerise via a Dockerfile:
No YAML. No Kubernetes. No build-pipeline edits. No per-service resource tuning — one flat workspace price covers everything.
MIT — © 2026 Global Software Development SRL
FAQs
CLI for PreviewDrop — live preview environments for every branch. Any Dockerfile, any stack.
The npm package previewdrop receives a total of 0 weekly downloads. As such, previewdrop popularity was classified as not popular.
We found that previewdrop demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.