
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@ht2-labs/semantic-release
Advanced tools
A package containing HT2 Labs' Semantic Release scripts
Package containing HT2 Labs' scripts for Semantic Release.
ONLY WORKS WITH NODE 8 AND ABOVE IN CI
npm i -D -E @ht2-labs/semantic-release@latest
.semantic-release
script to your package.json
file using one of the scripts.npm run semantic-release
after successful builds in your CI config.GH_TOKEN
to your CI environment. If you'd like to use @HT2Bot, @ryansmith94 can provide the token, but you'll need to add @HT2Bot to your repo.NPM_TOKEN
to your CI environment (only for "public" projects).DOCKER_EMAIL
DOCKER_USERNAME
DOCKER_PASSWORD
Note that if you're using this for a "public" (npm published) project and your scoping the project to the ht2-labs npm organisation you must include the following snippet in your package.json
file.
"publishConfig": {
"access": "public"
}
Project | Script |
---|---|
Public CircleCI App | ht2-release-public-circleci-app |
Public CircleCI Lib | ht2-release-public-circleci-lib |
Public CircleCI Lib (/dist only) | ht2-release-public-circleci-lib-dist |
Public TravisCI App | ht2-release-public-travisci-app |
Public TravisCI Lib | ht2-release-public-travisci-lib |
Private CircleCI | ht2-release-private-circleci |
Private TravisCI | ht2-release-private-travisci |
- deploy:
name: Release
command: npm run semantic-release
after_success:
- npm run semantic-release
FAQs
A package containing HT2 Labs' Semantic Release scripts
We found that @ht2-labs/semantic-release demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.