🚨 SlowMist TI Alert 🚨
MistEye has received critical threat intelligence regarding an active supply chain attack compromising node-ipc, a foundational Node.js library. The malicious releases have been identified as versions 9.1.6, 9.2.3, and 12.0.1.
Threat actors injected an obfuscated credential-stealing payload into the CommonJS bundle. Once loaded, it silently harvests over 90 categories of developer data—including AWS, Azure, GCP, SSH, K8s tokens, and Terraform states—and exfiltrates it to attacker-controlled infrastructure. We have synchronized this IOC with our clients immediately.
Detection & Remediation:
Please urgently audit your environments for exposure:
• Dependencies: Run npm ls node-ipc --all to identify direct or transitive inclusions.
• Lockfiles: Search package-lock.json, yarn.lock, or pnpm-lock.yaml for the affected version ranges.
• CI/CD: Review pipeline jobs executed after May 14, 2026, that may have pulled loose semver updates (~9.1.x, ^12, etc.).
⚠️ Critical Action: If a compromised version was installed, assume certain compromise. Do not wait for exfiltration confirmation. Downgrade to a known safe version immediately and aggressively rotate all credentials, tokens, and environment secrets present on the affected machine or CI runner.
As always, stay vigilant!
【acosta!@SEOUL】
2026년 6월 27일(토)~6월 28일(일)
✨인기 코스플레이어 'yami' 출연 결정! ✨
드디어 'yami'님이 아코스타! 서울에 찾아옵니다! 🎉
한국 첫 개최! 화려한 라인업의 마르쉐도 동시 개최!
티켓 예매 오픈도 조금만 기다려 주세요! 🎫✨
Introducing Hermes Curator!
The new system built in to Hermes Agent now helps you keep your skills that the self improvement loop creates in check, by consolidating and pruning automatically.
The curator does multiple things:
- keeps track of how often you use each skill, when it was last updated/created, etc
- Once a week runs automatically (configurable)
- Uses the analytics plus it's own scanning of your skills and consolidates or prunes them if necessary
- Skips externally installed skills, built in skills, and skills you "pin" that you dont' want touched. It will only attempt curation over agent created/updated skills or user written skills.
- It will then determine whether skills can be consolidated, pruned, or otherwise made more manageable. It will convert some skills that are too specific into references, templates or scripts for larger/broader skills, or integrate them directly into a consolidation of an existing skill.
You can also disable it entirely in the config.yaml and/or run it manually with `hermes curator run `
Learn more on the docs here: