
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@decaf-ts/alfred
Advanced tools
Library to help manage releases, and project creation using templates
Alfred is a tool designed to streamline the release process by enabling Git tag releases. It triggers CI/CD pipelines and generates projects from templates.
Defaults to module, but exports to CommonJS and ESM.
With documentation, update and release mechanisms and gitlab/github workflows to match;
Defines a 'way' to write jsDocs to optimize the output
Optimized for github in terms of badges. CI is equivalent between Gitlab and Github.
Auto setup on first npm install
Will accept a .token
file containing token valid for private npm dependencies, npm and docker registries
create a new project using this one as a template.
clone it git clone <project>
and navigate to the root folder cd <project>
.npmrc
containing:@<scope1>:registry=https://<ADDRESS>.com/api/v4/packages/npm/
@<scope2>:registry=https://<ADDRESS>.<DOMAIN>.com/api/v4/packages/npm/
//<ADDRESS>.<DOMAIN>.com/:_authToken=${TOKEN}
//<ADDRESS>.<DOMAIN>.com/api/v4/groups/<GROUP_ID>/packages/npm/:_authToken=${TOKEN}
//<ADDRESS>.<DOMAIN>.com/api/v4/projects/<PROJECT_ID>/packages/npm/:_authToken=${TOKEN}
Changing:
.
);and adding a .token
file containing your access token to the private registries na repositories.
Run npm install
(or npm run do-install
if you have private dependencies and a .token
file) to install the dependencies:
If this is the first time you are running this command it will also:
.token
file which you can leave empty unless you have private dependencies or publish to private registriespackage.json
;package.json
and deleted files (having ssh access helps here);This repo comes with eslint + prettier preconfigured to the default standards
Preconfigured Jest based testing:
tests/unit
folder;
tests/integration
folder;workdocs/coverage
;cli.ts
from coverage since that is an executable file;jest.config.ts
;This repository automates releases in the following manner:
npm run release -- <major|minor|patch|version> <message>
:
npm run prepare-release
npm script;If publishing to a private repo's npm registry, make sure you add to your package.json
:
{
"publishConfig": {
"<SCOPE>:registry": " https://<REGISTRY>/api/v4/projects/<PROJECT_ID>/packages/npm/"
}
}
Where:
<SCOPE>
- Is the scope of your package;<REGISTRY>
- your registry host;<PROJECT_ID>
- you project ID number (easy to grab via UI in gitlab or by
running $("meta[name=octolytics-dimension-repository_id]").getAttribute('content')
in the repository page in github)
;Unless the -no-ci
flag is passed in the commit message to the npm run release
command, publishing will be handled
automatically by github/gitlab (triggered by the tag).
When the -no-ci
flag is passed then you can:
npm run publish
. This command assumes :
npm run release
;npmrc
and package.json
;.token
file;While the implementationfor gitlab and github are not perfectly matched, they are perfectly usable.
The template comes with ci/cd for :
package-lock.json
changes, caches node modules);src/*
changes, caches lib
and dist
);src/*
, test/*
changes, caches workdocs/{resources, badges, coverage}
);install -> build -> test
loop;-no-ci
string-no-ci
stringThe repository proposes a way to generate documentation that while still not ideal, produces verys consitest results.
In the code you see an example on how to properly document each code object, but the overall structure is:
@module
;@category
and @subcategory
;@namespace
and @memberOf
;@const
and both must describe their properties as @property
(when constants are objects);@method
;There are 3 steps the generating the documentation (automated in CI):
npm run drawings
- generates png files from each drawing in the workdocs/drawings
folder and moves them to the workdocs/resources
folder (requires Docker);npm run uml
- generates png files from each PlantUML diagram in the workdocs/uml
folder and moves them to the workdocs/resources
folder (requires Docker);npm run docs
- this has several stages, defined under the gulp docs
(gulpfile.js):
/docs
;./workdocs/{drawings, uml, assets, resources}
to ./docs
;The produced docs
folder contains the resulting documentation;
The following npm scripts are available for development:
preinstall
- will run only on the first install to trigger the dep update. will self delete;do-install
- sets a TOKEN
environment variable to the contents of .token
and runs npm install (useful when you
have private dependencies);flash-forward
- updates all dependencies. Take care, This may not be desirable is some cases;reset
- updates all dependencies. Take care, This may not be desirable is some cases;build
- builds the code (via gulp gulpfile.js
) in development mode (generates lib
and dist
folder);build:prod
- builds the code (via gulp gulpfile.js
) in production mode (generates lib
and dist
folder);test
- runs unit tests;test:integration
- runs it tests;test:all
- runs all tests;lint
- runs es lint on the code folder;lint-fix
- tries to auto-fix the code folder;prepare-release
- defines the commands to run prior to a new tag (defaults to linting, building production code,
running tests and documentation generation);release
- triggers a new tag being pushed to master (via ./bin/tag_release.sh
);clean-publish
- cleans the package.json for publishing;coverage
- runs all test, calculates coverage and generates badges for readme;drawings
- compiles all DrawIO *.drawio
files in the workdocs/drawings
folder to png and moves them to
the workdocs/resources
folder;uml
- compiles all PlantUML *.puml
files in the workdocs/uml
folder to png and moves them to
the workdocs/resources
folder;docs
- compiles all the coverage, drawings, uml, jsdocs and md docs into a readable web page under ./docs
;ts-workspace
│
│ .gitignore <-- Defines files ignored to git
│ .npmignore <-- Defines files ignored by npm
│ .nmprc <-- Defines the Npm registry for this package
│ .eslintrc.cjs <-- linting for the project
│ .prettier.config.cjs <-- Code style for the project
│ .gitlab-ci.yml <-- Gillab CI/CD file
│ gulpfile.js <-- Gulp build scripts. used for building na other features (eg docs)
│ jest.config.ts <-- Tests Configuration file
│ mdCompile.json <-- md Documentation generation configuration file
│ jsdocs.json <-- jsdoc Documentation generation configuration file
│ Dockerfile <-- minimal example of a node service Dockerfile
│ LICENCE.md <-- Licence disclamer
│ package.json
│ package-lock.json
│ README.md <-- Readme File dynamically compiled from 'workdocs' via the 'docs' npm script
│ tsconfig.json <-- Typescript config file. Is overriden in 'gulpfile.js'
│
└───bin
│ │ tag_release.sh <-- Script to help with releases
│
└───docs
│ │ ... <-- Dinamically generated folder, containing the compiled documentation for this repository. generated via the 'docs' npm script
│
└───src
│ │ ... <-- Source code for this repository
│
└───tests
│ │───unit <-- Unit tests
│ └───integration <-- Integration tests
│
└───workdocs <-- Folder with all pre-compiled documentation
│ │───assets <-- Documentation asset folder
│ │───badges <-- Auto generated coverage badges folder
│ │───coverage <-- Auto generated coverage results
│ │───drawings <-- DrawIO folder. Drawings (*.drawio) here will be processed to generate documentation (requires docker)
│ │───uml <-- PlantUML folder. Diagrams (*.puml) here will be processed to generate documentation (requires docker)
│ │───tutorials <-- Tutorial folder
│ │ ... <-- Categorized *.md files that are merged to generate the final readme (via md compile)
│ │ Readme.md <-- Entry point to the README.md
│
└───dist
│ │ ... <-- Dinamically generated folder containing the bundles for distribution
│
└───lib
| ... <-- Dinamically generated folder containing the compiled code
If you have bug reports, questions or suggestions please create a new issue.
I am grateful for any contributions made to this project. Please read this to get started.
The first and easiest way you can support it is by Contributing. Even just finding a typo in the documentation is important.
Financial support is always welcome and helps keep the both me and the project alive and healthy.
So if you can, if this project in any way. either by learning something or simply by helping you save precious time, please consider donating.
This project is released under the MIT License.
FAQs
Library to help manage releases, and project creation using templates
The npm package @decaf-ts/alfred receives a total of 3 weekly downloads. As such, @decaf-ts/alfred popularity was classified as not popular.
We found that @decaf-ts/alfred demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.