
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
tekmemoCore runtime. Core memory contracts, records, chunks, source references, manifest validation, local protocol helpers, and provider-neutral runtime primitives.
pnpm add tekmemo
import { createMemoryRecord } from "tekmemo";
const record = createMemoryRecord({
kind: "decision",
content: "Use local-first memory for development.",
source: { type: "manual" },
});
This package owns its package-level contract only. It does not own TekMemo Cloud billing, dashboards, tenancy, hosted database storage, or provider secrets unless explicitly stated by its package name.
For hosted memory, use @tekmemo/cloud-client. For local file-backed memory, use tekmemo with @tekmemo/fs. For MCP tools, use @tekmemo/mcp-server.
pnpm --filter tekmemo typecheck
pnpm --filter tekmemo test:run
pnpm --filter tekmemo build
pnpm --filter tekmemo lint:package
tekmemodist/**/*.mjs + dist/**/*.d.mtsdist/**/*.cjs + dist/**/*.d.ctsdist and README.md@tekmemo/cloud-client unless this package is @tekmemo/cloud-client itself.Before publishing this package, run:
pnpm --filter tekmemo release:check
The package-level check builds dist/, runs TypeScript and tests, runs publint, and performs npm pack --dry-run. Publish from CI with Changesets and npm trusted publishing/provenance after the root release preflight passes.
MIT.
FAQs
Provider-neutral core memory runtime for AI apps and agents.
The npm package tekmemo receives a total of 0 weekly downloads. As such, tekmemo popularity was classified as not popular.
We found that tekmemo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.