Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
github.com/tomferreira/action-bundler-audit
This action runs bundler-audit with reviewdog on pull requests to improve code review experience.
github_token
GITHUB_TOKEN
. Default is ${{ github.token }}
.
bundler_audit_version
Optional. Set bundler-audit version. Possible values:
gemfile
: install version from Gemfile (Gemfile.lock
should be presented, otherwise it will fallback to latest bundler version)1.9.0
): install said versionbundler_audit_flags
Optional. bundler-audit flags. (bundler-audit check --format json <bundler_audit_flags>
).
tool_name
Optional. Tool name to use for reviewdog reporter. Useful when running multiple actions with different config.
level
Optional. Report level for reviewdog [info
, warning
, error
].
It's same as -level
flag of reviewdog.
reporter
Optional. Reporter of reviewdog command [github-pr-check
, github-check
, github-pr-review
].
The default is github-pr-check
.
filter_mode
Optional. Filtering mode for the reviewdog command [added
, diff_context
, file
, nofilter
].
Default is added
.
fail_on_error
Optional. Exit code for reviewdog when errors are found [true
, false
].
Default is false
.
reviewdog_flags
Optional. Additional reviewdog flags.
workdir
Optional. The directory from which to look for and run bundler-audit. Default .
.
name: reviewdog
on: [pull_request]
jobs:
bundler_audit:
name: runner / bundler_audit
runs-on: ubuntu-latest
steps:
- name: Check out code
uses: actions/checkout@v2
- uses: ruby/setup-ruby@v1
with:
ruby-version: 3.0.0
- name: bundler_audit
uses: tomferreira/action-bundler-audit@v1
with:
bundler_audit_version: gemfile
# Change reviewdog reporter if you need [github-check,github-pr-review,github-pr-check].
reporter: github-pr-review
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.