
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@metamask/auto-changelog
Advanced tools
Utilities for validating and updating "Keep a Changelog" formatted changelogs
Utilities for validating and updating "Keep a Changelog" formatted changelogs.
This package has a CLI (auto-changelog
), and an API.
yarn add --dev @metamask/auto-changelog
or
npm install --save-dev @metamask/auto-changelog
To update the 'Unreleased' section of the changelog:
npx @metamask/auto-changelog update
To update the current release section of the changelog:
npx @metamask/auto-changelog update --rc
To validate the changelog:
npx @metamask/auto-changelog validate
To validate the changelog in a release candidate environment:
npx @metamask/auto-changelog validate --rc
Each supported command is a separate named export.
updateChangelog
This command updates the changelog.
import { promises as fs } from 'fs';
import { updateChangelog } from '@metamask/auto-changelog';
const oldChangelog = await fs.readFile('CHANGELOG.md', {
encoding: 'utf8',
});
const updatedChangelog = updateChangelog({
changelogContent: oldChangelog,
currentVersion: '1.0.0',
repoUrl: 'https://github.com/ExampleUsernameOrOrganization/ExampleRepository',
isReleaseCandidate: false,
});
await fs.writeFile('CHANGELOG.md', updatedChangelog);
validateChangelog
This command validates the changelog
import { promises as fs } from 'fs';
import { validateChangelog } from '@metamask/auto-changelog';
const oldChangelog = await fs.readFile('CHANGELOG.md', {
encoding: 'utf8',
});
try {
validateChangelog({
changelogContent: oldChangelog,
currentVersion: '1.0.0',
repoUrl:
'https://github.com/ExampleUsernameOrOrganization/ExampleRepository',
isReleaseCandidate: false,
});
// changelog is valid!
} catch (error) {
// changelog is invalid
}
nvm use
will automatically choose the right node version for you.yarn setup
to install dependencies and run any requried post-install scripts
yarn
/ yarn install
command directly. Use yarn setup
instead. The normal install command will skip required post-install scripts, leaving your development environment in an invalid state.Run yarn test
to run the tests once. To run tests on file changes, run yarn test:watch
.
Run yarn lint
to run the linter, or run yarn lint:fix
to run the linter and fix any automatically fixable issues.
The project follows the same release process as the other libraries in the MetaMask organization:
Create a release branch
main
1.x
)Update the changelog
Update version in package.json file (e.g. yarn version --minor --no-git-tag-version
)
Create a pull request targeting the base branch (e.g. master or 1.x)
Code review and QA
Once approved, the PR is squashed & merged
The commit on the base branch is tagged
The tag can be published as needed
[2.3.0]
Changelog
class, createEmptyChangelog
, and parseChangelog
.git rev-list
. For all repositories, this caused most tags belonging to merge commits to be excluded. For monorepos, this also caused tags belonging to commits that didn't change any files belonging to the changelog's package / workspace to be excluded.FAQs
Utilities for validating and updating "Keep a Changelog" formatted changelogs
The npm package @metamask/auto-changelog receives a total of 6,081 weekly downloads. As such, @metamask/auto-changelog popularity was classified as popular.
We found that @metamask/auto-changelog demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.