
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
@google-automations/datastore-lock
Advanced tools
This is a simple lock library backed by Google Cloud Datastore.
Github bots can have multiple instances and sometimes those instances are modifying the same target (issue, pull request, etc). This simple library allows the bot to acquire a lock on sth.
npm i @google-automations/datastore-lock
import {DatastoreLock} from '@google-automations/datastore-lock';
// Most of the cases, you can just pass `lockId` and `target`.
// `lockId` is usually the bot name.
// `target` is the target for the lock.
const lockId = 'blunderbuss';
const target = context.payload.pull_request.url;
const lock = new DatastoreLock(lockId, target);
// await lock.peek(); // was there already a lock perhaps?
const result = await lock.acquire();
if (!result) {
// failure
}
// Do your stuff, and release the lock after you've done.
result = await lock.release();
// The lock will become stale after 20 seconds.
// You can pass the 3rd argument for longer expiry, up to 60 seconds.
const lock2 = new DatastoreLock(lockId, target, 60 * 1000);
FAQs
Distributed lock backed by Google Cloud Datastore
The npm package @google-automations/datastore-lock receives a total of 2,163 weekly downloads. As such, @google-automations/datastore-lock popularity was classified as popular.
We found that @google-automations/datastore-lock demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.