
Research
Malicious NuGet Packages Typosquat Nethereum to Exfiltrate Wallet Keys
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
@actions/github
Advanced tools
@actions/github
A hydrated Octokit client.
Returns an authenticated Octokit client that follows the machine proxy settings and correctly sets GHES base urls. See https://octokit.github.io/rest.js for the API.
const github = require('@actions/github');
const core = require('@actions/core');
async function run() {
// This should be a token with access to your repository scoped in as a secret.
// The YML workflow will need to set myToken with the GitHub Secret Token
// myToken: ${{ secrets.GITHUB_TOKEN }}
// https://help.github.com/en/actions/automating-your-workflow-with-github-actions/authenticating-with-the-github_token#about-the-github_token-secret
const myToken = core.getInput('myToken');
const octokit = github.getOctokit(myToken)
// You can also pass in additional options as a second parameter to getOctokit
// const octokit = github.getOctokit(myToken, {userAgent: "MyActionVersion1"});
const { data: pullRequest } = await octokit.rest.pulls.get({
owner: 'octokit',
repo: 'rest.js',
pull_number: 123,
mediaType: {
format: 'diff'
}
});
console.log(pullRequest);
}
run();
You can also make GraphQL requests. See https://github.com/octokit/graphql.js for the API.
const result = await octokit.graphql(query, variables);
Finally, you can get the context of the current action:
const github = require('@actions/github');
const context = github.context;
const newIssue = await octokit.rest.issues.create({
...context.repo,
title: 'New issue!',
body: 'Hello Universe!'
});
The npm module @octokit/webhooks-definitions
provides type definitions for the response payloads. You can cast the payload to these types for better type information.
First, install the npm module npm install @octokit/webhooks-definitions
Then, assert the type based on the eventName
import * as core from '@actions/core'
import * as github from '@actions/github'
import {PushEvent} from '@octokit/webhooks-definitions/schema'
if (github.context.eventName === 'push') {
const pushPayload = github.context.payload as PushEvent
core.info(`The head commit is: ${pushPayload.head_commit}`)
}
@octokit/core
now supports the plugin architecture. You can extend the GitHub instance using plugins.
For example, using the @octokit/plugin-enterprise-server
you can now access enterprise admin apis on GHES instances.
import { GitHub, getOctokitOptions } from '@actions/github/lib/utils'
import { enterpriseServer220Admin } from '@octokit/plugin-enterprise-server'
const octokit = GitHub.plugin(enterpriseServer220Admin)
// or override some of the default values as well
// const octokit = GitHub.plugin(enterpriseServer220Admin).defaults({userAgent: "MyNewUserAgent"})
const myToken = core.getInput('myToken');
const myOctokit = new octokit(getOctokitOptions(token))
// Create a new user
myOctokit.rest.enterpriseAdmin.createUser({
login: "testuser",
email: "testuser@test.com",
});
github-api is another JavaScript package that provides an interface to the GitHub API. It offers functionalities similar to @actions/github, such as repository management and issue handling. However, github-api is not specifically tailored for GitHub Actions and might be more suitable for general GitHub API interactions within JavaScript applications. It differs from @actions/github by its broader focus, not being limited to GitHub Actions workflows.
FAQs
Actions github lib
The npm package @actions/github receives a total of 2,242,192 weekly downloads. As such, @actions/github popularity was classified as popular.
We found that @actions/github demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
The Socket Threat Research Team uncovered malicious NuGet packages typosquatting the popular Nethereum project to steal wallet keys.
Product
A single platform for static analysis, secrets detection, container scanning, and CVE checks—built on trusted open source tools, ready to run out of the box.
Product
Socket is launching experimental protection for the Hugging Face ecosystem, scanning for malware and malicious payload injections inside model files to prevent silent AI supply chain attacks.