Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@kgryte/github-get
Advanced tools
Retrieves resources from a Github API endpoint.
$ npm install @kgryte/github-get
var request = require( '@kgryte/github-get' );
Retrieves resources from a Github API endpoint.
request( onResponse );
function onResponse( error, data, info ) {
// Check for rate limit info...
if ( info ) {
console.error( 'Limit: %d', info.limit );
console.error( 'Remaining: %d', info.remaining );
console.error( 'Reset: %s', (new Date( info.reset*1000 )).toISOString() );
}
if ( error ) {
throw error;
}
console.log( JSON.stringify( data ) );
// returns <response_data>
}
The function
accepts the following options
:
'https'
.'api.github.com'
.443
(https) or 80
(http)./user/repos
. Default: '/'
.1
.function
will use link headers to resolve all pages starting from page
. Default: 1
.100
.'application/vnd.github.moondragon+json'
.string
.To specify a particular resource endpoint, set the pathname
option.
var opts = {
'pathname': '/user/repos'
};
request( opts, onResponse );
To authenticate with an endpoint, set the token
option.
var opts = {
'token': 'tkjorjk34ek3nj4!'
};
request( opts, onResponse );
By default, the function
only requests a single page of results. To resolve multiple pages, set the last_page
option.
// Resolves pages 2-5...
var opts = {
'page': 2,
'last_page': 5
};
request( opts, onResponse );
To specify that all pages beginning from page
be resolved, set the last_page
option to 'last'
.
// Resolve all pages...
var opts = {
'last_page': 'last'
};
request( opts, onResponse );
To specify a user agent, set the useragent
option.
var opts = {
'useragent': 'hello-github!'
};
request( opts, onResponse );
Creates a reusable function
.
var opts = {
'pathname': '/user/repos',
'last_page': 'last',
'token': 'tkjorjk34ek3nj4!'
};
var get = request.factory( opts, clbk );
get();
get();
get();
// ...
The factory method accepts the same options
as request()
.
error
while initially querying an endpoint (e.g., no network connection, malformed request, etc), that error
is returned immediately to the provided callback
.object
or an object array
. If multiple pages are resolved, response data is always an object array
.function
will honor the last_page
option as long as the option value does not exceed the maximum number of available pages.var request = require( '@kgryte/github-get' );
var opts = {
'hostname': 'api.github.com',
'pathname': '/user/repos',
'useragent': 'my-unique-agent',
'accept': 'application/vnd.github.moondragon+json',
'token': 'tkjorjk34ek3nj4!',
'last_page': 'last'
};
request( opts, onResponse );
function onResponse( error, data, info ) {
if ( info ) {
console.error( info );
}
if ( error ) {
throw error;
}
console.log( data );
}
To run the example code from the top-level application directory,
$ DEBUG=* node ./examples/index.js
Note: in order to run the example, you will need to obtain an access token and modify the token
option accordingly.
To use the module as a general utility, install the module globally
$ npm install -g @kgryte/github-get
Usage: ghget [options]
Options:
-h, --help Print this message.
-V, --version Print the package version.
--protocol protocol Request protocol. Default: https.
--hostname host Hostname. Default: api.github.com.
-p, --port port Port. Default: 443 (https) or 80 (http).
--pathname pathname Resource pathname. Default: '/'.
--token token Github access token.
--accept media_type Media type. Default: application/vnd.github.v3+json.
-ua, --useragent ua User-agent.
--page page Resource page. Default: 1.
--last_page page Last resource page to resolve. Default: 1.
--per_page size Page size. Default: 100.
token
option, the token may also be specified by a GITHUB_TOKEN
environment variable. The command-line option always takes precedence.stdout
.stderr
.Setting the access token using the command-line option:
$ DEBUG=* ghget --token <token> --pathname '/user/repos'
# => '[{...},{...},...]'
Setting the access token using an environment variable:
$ DEBUG=* GITHUB_TOKEN=<token> ghget --pathname '/user/repos'
# => '[{...},{...},...]'
For local installations, modify the command to point to the local installation directory; e.g.,
$ DEBUG=* ./node_modules/.bin/ghget --token <token> --pathname '/user/repos'
# => '[{...},{...},...]'
Or, if you have cloned this repository and run npm install
, modify the command to point to the executable; e.g.,
$ DEBUG=* node ./bin/cli --token <token> --pathname '/user/repos'
# => '[{...},{...},...]'
This repository uses tape for unit tests. To run the tests, execute the following command in the top-level application directory:
$ make test
All new feature development should have corresponding unit tests to validate correct functionality.
This repository uses Istanbul as its code coverage tool. To generate a test coverage report, execute the following command in the top-level application directory:
$ make test-cov
Istanbul creates a ./reports/coverage
directory. To access an HTML version of the report,
$ make view-cov
This repository uses Testling for browser testing. To run the tests in a (headless) local web browser, execute the following command in the top-level application directory:
$ make test-browsers
To view the tests in a local web browser,
$ make view-browser-tests
Copyright © 2015-2016. Athan Reines.
FAQs
Retrieves resources from a Github API endpoint.
The npm package @kgryte/github-get receives a total of 1 weekly downloads. As such, @kgryte/github-get popularity was classified as not popular.
We found that @kgryte/github-get demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.