Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@bryphe/esy-307
Advanced tools
package.json
workflow for native development with Reason/OCaml.
This README serves as a development documentation for esy. For user documentation refer to esy.sh documentation site.
esy-build-package
— source code for esy-build-package
commandesy
— source code for esy
core commandsesy-install
— source code for esy install
, esy add
and other yarn-based
command.
esy-install/esy-install
— this is a submodule which points to
esy/esy-install
repo, a fork of yarn
.test
— unit teststest-e2e
— integration tests for esy
test-opam
— "OPAM top 100 packages" test suitelinux-build
— Docker based macOS to Linux cross compilation infraTo make changes to esy
and test them locally:
% git clone git://github.com/esy/esy.git
% cd esy
% make bootstrap
Run:
% make
to see the description of development workflow.
% make test
There are two branches:
master
— the active development, we cut new versions out of there regularly.0.0.x
— maintainance branch for 0.0.x releases.Issues are tracked at esy/esy.
esy is released on npm.
Because esy is written in OCaml/Reason and compiled into a native executable we need to acquire a set of prebuilt binaries. We employ CI servers (thanks Travis CI) to build platform specific releases.
The release workflow is the following:
Ensure you arre on master
branch and run
% make bump-patch-verson
% git push && git push --tags
(this bumps patch version, use bump-minor-version
or bump-major-version
correspondingly to bump either minor or major version of esy)
Wait till CI finishes its task and uploads releases on GitHub, check https://github.com/esy/esy/releases for them.
Run
% make release
Which downloads platform specific releases (which CI uploaded GitHub) and
produces an npm releases with needed metadata inside _release
directory.
Ensure release inside _release
directory is ok.
You can cd _release && npm pack && npm install -g ./esy-*.tgz
to test how
release installs and feels.
Run cd _release && npm publish
to publish release on npm.
Release tag next
is used to publish preview releases.
FAQs
Package builder for esy
We found that @bryphe/esy-307 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.