
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@hyperlog/github-contribs
Advanced tools
List all List all GitHub repos a user has contributed to since the beginning
NOTE: This project is derivative work of (@ghuser/github-contribs)[https://github.com/ghuser-io/github-contribs]
List all GitHub repos a user has contributed to since the beginning:
$ github-contribs AurelienLourot
✔ Fetched first day at GitHub: 2015-04-04.
⚠ Be patient. The whole process might take up to an hour... Consider using --since and/or --until
✔ Fetched all commits and PRs. Consider using --issues to fetch issues as well.
35 repo(s) found:
AurelienLourot/lsankidb
reframejs/reframe
dracula/gitk
...
$ sudo npm install -g @ghuser/github-contribs
To run your local changes:
$ yarn install
$ ./cli.js --help
Thanks goes to these wonderful people (emoji key):
Aditya Giri 🚇 ⚠️ 💻 |
This project follows the all-contributors specification. Contributions of any kind welcome!
Normally in order to retrieve all repositories a user has interacted with, one should query the GitHub Events API. Unfortunately it returns only the last 90 days, so we don't use it.
Instead we noticed that the "Contribution Activity" section's content on the profile pages comes from URLs like https://github.com/AurelienLourot?from=2018-10-09 .
So we're fetching these URLs too and parsing their output.
We hit a rate limit. And since it's not an official API, we can't use a token to raise the limit.
NOTE: the rate limit seems to be 40 requests / minute / endpoint / IP. Thus even if crawling a single user takes about 3 hours on a single machine, crawling many users in parallel on that same machine should still take about 3 hours.
Yes, it is since that interface isn't public. We're monitoring it1 and will react as fast as we can when it breaks.
1 ghuser.io runs
this tool every day.
github-contribs missed some of my commits. Why?github-contribs can only discover commits considered as
GitHub contributions,
i.e. commits that would also appear in the activity section of your GitHub profile. For example it
doesn't discover commits in forks.
FAQs
List all List all GitHub repos a user has contributed to since the beginning
We found that @hyperlog/github-contribs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.