
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
vasperamesh
Advanced tools
VasperaMesh CLI — authenticate from your terminal and wire your AI agents into the tamper-evident audit ledger.
The VasperaMesh CLI. Authenticate from your terminal and get a Mesh key that routes your AI agents' model calls through the VasperaMesh proxy — every generation becomes one immutable row in a tamper-evident, Bitcoin-anchored audit ledger you can verify offline.
npx vasperamesh login # authenticate in your browser, write MESH_KEY to .env
npx vasperamesh init # login, then print a prompt you paste into Claude Code / Cursor
login opens your browser to approve the request (you must be signed in to your VasperaMesh
account), then writes MESH_KEY to .env in the current directory. The key belongs to your
organization and counts toward your plan — it is only ever issued after you approve it in an
authenticated session.
Then point your model client at the proxy (or run init and let your AI coding agent do it):
// Anthropic SDK
new Anthropic({
baseURL: "https://www.vasperamesh.com/api/proxy",
defaultHeaders: { "x-mesh-key": process.env.MESH_KEY, "x-mesh-agent": "my-agent" },
})
Your provider API key is unchanged and passes straight through. It's observe-only and fail-open: if the proxy is ever unreachable, your calls still succeed.
MESH_HOST — override the VasperaMesh host (default https://www.vasperamesh.com).Requires Node.js ≥ 18. No dependencies.
FAQs
VasperaMesh CLI — authenticate from your terminal and wire your AI agents into the tamper-evident audit ledger.
We found that vasperamesh demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.