
Security News
Re-Enabled GitHub Actions Expose Thousands of Repositories to Mini Shai-Hulud
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.
Tiny LCG class for seed-based value generation.
npm install tiny-rng --sconst prng = reqire('tiny-rng');
// constructor params
// @_precision <optional number default 3> -> number of decimal places (0 = integer)
// @_seed <optional number default Date.now() % 2**32-1> -> starting seed of prng instance
// @_a <optional number default 16807> -> LCG multiplier
// @_c <optional number default 0> -> LCG increment
// @_modulus <optional number default 2**32-1 -> LCG modulus
const r = new prng(_precision, _seed, _a, _c, _modulus);
// random() params
// @min <optional number default 0> -> minimum output
// @max <optional number default 1> -> maximum output
// @precision <optional number default instance.precision> -> decimal precision of output
// passing this parameter can be used to override the current precision of the instance without changing it.
let random_value = r.random(min, max, precision);
// setPrecision()
r.setPrecision(2);
// basic usage
const r = new prng(); // default seed and precision (3)
r.random() // default range (min: 0, max: 1)
> 0.xxx - 1.000
const r = new prng(0, 58973); // precision: 0 (returns integer), seed: 58973
const arr = [];
for (let i = 0; i < 10; i++) {
arr.push(r.random(0, 100)); // min: 0, max: 100
}
arr > [ 54, 46, 42, 40, 65, 60, 81, 39, 60, 66 ]
FAQs
Tiny LCG utility for seed-based value generation.
The npm package tiny-rng receives a total of 0 weekly downloads. As such, tiny-rng popularity was classified as not popular.
We found that tiny-rng demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.

Security News
Two compromised GitHub Actions were re-enabled with malicious tags intact, exposing thousands of downstream repositories to Mini Shai-Hulud.

Research
/Security News
A malicious Firefox extension fetches its payload after installation to evade detection, steal Google session cookies, and automate account takeover.

Research
/Security News
The compromise affects MemTensor's MemOS, an open source memory framework for large language models (LLMs) and AI agents. Both npm package @memtensor/memos-cloud-openclaw-plugin and the PyPI package MemoryOS are compromised. They drop cross-platform Go binaries that exfiltrate developer secrets.