
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
@code-dot-org/maze
Advanced tools
Standalone repo for the Maze app type
Check this project out from source:
git clone git@github.com:code-dot-org/maze.git
cd maze
Next, inside the project, you need to install the project's various dependencies.
yarn install
Now you should be able to run all the tests:
yarn test
And spin up a development build of your new project:
yarn build
In this repo:
yarn link
In main repo's apps/
directory:
yarn link @code-dot-org/maze
This will set up a symlink in main repo's apps/node_modules/ to point at your local changes.
Run
yarn run build
in this repo, and then the main repo's apps
build should pick the changes up next time it builds.
If you are running yarn start
for continuous builds in the main repo, it will pick up the changes once the build in this repo has completed.
In /maze: npm login with an authorized npm account. If necessary, create one under your own email, login with our shared dev account and add your new account to the org. After logging in, you may need to authorize your machine (follow the prompt given):
npm login
npm adduser (if necessary)
Still in /maze: checkout main, and ensure it is up-to-date:
git checkout main
git pull
Verify the existing code doesn't have errors or failing tests:
yarn build
yarn test
Then, update the version (which also publishes to npm):
npm version [major|minor|patch|premajor|preminor|prepatch].
Verify there is a new commit on /maze/main with the updated version number.
In the @code-dot-org repo, incorporate the new version of maze:
git checkout -b [maze-updates-we-are-incorporating]
cd apps
yarn add @code-dot-org/maze@my.new.version (ex: yarn add @code-dot-org/maze@2.7.0)
Verify yarn.lock and package.json have been updated.
Commit and push changes, and open and merge a PR.
FAQs
standalone project for the Maze app type
We found that @code-dot-org/maze demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 11 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.