
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
Simplifies xbar (previous known as BitBar) app plugin creation
Create your plugin using a nice API instead of having to manually construct a big string.
Requires xbar v2 or later.
npm install @sindresorhus/xbar
#!/usr/bin/env node
import xbar, {separator, isDarkMode} from '@sindresorhus/xbar';
xbar([
{
text: '❤',
color: isDarkMode ? 'white' : 'red',
dropdown: false
},
separator,
{
text: 'Unicorns',
color: '#ff79d7',
submenu: [
{
text: ':tv: Video',
href: 'https://www.youtube.com/watch?v=9auOCbH5Ns4'
},
{
text: ':book: Wiki',
href: 'https://en.wikipedia.org/wiki/Unicorn'
}
]
},
separator,
'Ponies'
]);
Create a file with the above code in the xbar plugins directory and make sure to chmod +x filename.js it. Read more.
Note: You need to either have a package.json file with {"type": "module"} or use the .mjs extension instead of .js.
Change node in #!/usr/bin/env node to the path of your Node.js binary. This is a known issue in xbar.
Type: Array<string | object>
An item can be a string with the text or an object with the text in a text property and any of the options. The text can be multiple lines, but for the first item, only the first line will be shown in the menubar.
Type: Array<string | object>
It will add a submenu to the current item. A submenu is composed of an array of items.
Type: object
You can use any of the supported options.
Applies to all items unless overridden in the item.
Add a separator.
Type: boolean
Check whether dark mode is enabled.
Type: boolean
Check whether the script is running from xbar.
FAQs
Simplifies xbar app plugin creation
We found that xbar demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.