Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@getyourguide/npm-publish
Advanced tools
Module to handle publishing new modules detecting the version type from the commit message and pushing to github.
package.json
and push to your github repo.npm install --save @getyourguide/npm-publish
package.json
{
"scripts": {
"publish": "npm-publish"
}
}
drone
to publish your modulepublish-package:
image: node:12-buster
commands:
- npm run publish -- -b "${DRONE_BRANCH}" -m '${DRONE_COMMIT_MESSAGE/"/}'
Run with --help
to get a full list of params
npm run publish -- --help
Options:
--version Show version number [boolean]
--help Show help [boolean]
--branch, -b branch name [required]
--message, -m commit message [required]
--publish-branches branches in which it should publish [default: "master"]
--wildcard-minor wildcard to identify a minor commit [default: "[minor]"]
--wildcard-major wildcard to identify a major commit [default: "[major]"]
--wildcard-beta wildcard to identify a beta commit [default: "[beta]"]
--wildcard-no-publish wildcard to identify a skip publish [default: "[nopublish]"]
Create a section in your package.json
and overide the default values
{
"npm-publish": {
"publish-branches": ["master"],
"wildcard-minor": "[minor]",
"wildcard-major": "[major]",
"wildcard-beta": "[beta]",
"wildcard-no-publish": "[nopublish]",
}
}
FAQs
Module to publish npm modules
We found that @getyourguide/npm-publish demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.