
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
serve-content
Advanced tools
serve-content based on file name extensions and serving jade and stylus files
All in serve-static documentation is working here. But serve-content add some mandatory parameters to indicate which are the allowed extensions:
allowedExts is a white list of extensions names for serve.
allowAllExts is a boolean. True means that all extensions are allowed. It can be used with excludeExts.
allowedExts is a black list with ignorings extensions.
var connect = require('connect')
var extensionServeStatic = require('serve-content')
var app = connect()
// Serve up all folders for images
app.use(serveContent('/', {
extensions: ['html', 'htm'],
index: 'index.html',
allowedExts: ['', 'html', 'htm', 'png', 'jpg', 'jpeg', 'gif']
})
// Listen
app.listen(3000)
For use the serve-static extensions parameter you must include de empty string ('') in the staticExtension list (as you see in the example).
serve-content also search the extension in the mime types. If you need to add a non standard extension you can add it in the mime field
var connect = require('connect')
var extensionServeStatic = require('serve-content')
var mime = extensionServeStatic.mime;
mime.types.specialimage = 'image/special';
var app = connect()
// Serve up all folders for images
app.use(serveContent('/', {
extensions: ['html', 'htm'],
index: 'index.html',
allowedExts: ['', 'html', 'htm', 'png', 'jpg', 'jpeg', 'gif', 'specialimage']
})
// Listen
app.listen(3000)
FAQs
Serve static files based on file name extensions
The npm package serve-content receives a total of 13 weekly downloads. As such, serve-content popularity was classified as not popular.
We found that serve-content demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.