
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@author.io/cicd-autotag
Advanced tools
Determines whether the local version of a module is newer than the latest published version of the module on the registry.
This Node.js-based CLI utility that will auto-tag node modules in git, according to their semantic version number. It is designed for use with drone.io, github, and npm. More specifically, it is used to respond to push/PR events on Github. When a new commit is pushed to master, drone.io responds and runs build steps. One of these steps can be an auto-tagger, which will automatically create a git tag and push it to Github. This, in turn, can trigger a Github Release and/or an npm publish.
package.json
.Installation
npm i @author.io/cicd-autotag
Usage
Drone.io uses a .drone.yml
file to configure build "steps". This module can be used to facilitate auto-tagging.
For example:
kind: pipeline
name: release
steps:
- name: autotag
image: node
environment:
GIT_USER:
from_secret: GITHUB_USERNAME
GIT_SECRET:
from_secret: GITHUB_KEY
commands:
- npm install -g @author.io/cicd-autotag
- autotag
when:
event:
- push
By default, autotag will not succeed if it cannot find the npm module in the npm registry. This feature prevents accidental publishing of new modules.
However; there are circumstances where new modules should by published. To do
this, pass the --allowInitialNpmPublish
flag to the command. For example:
commands:
- npm install -g @author.io/cicd-autotag
- autotag --allowInitialNpmPublish
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.