
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@naverpay/commit-helper
Advanced tools
Automatically adds issue numbers to commit messages based on branch names and protects important branches
npm install --save-dev @naverpay/commit-helper
# or
yarn add -D @naverpay/commit-helper
# or
pnpm add -D @naverpay/commit-helper
npm install --save-dev husky
npx husky init
echo 'npx --yes @naverpay/commit-helper@latest $1' > .husky/commit-msg
chmod +x .husky/commit-msg
git checkout -b feature/123-new-feature
git add .
git commit -m "Add new feature"
# Result: [#123] Add new feature
Extracts issue numbers from branch names and adds them to commit messages:
feature/123 → [#123] your messageqa/456 → [your-org/your-repo#456] your messagehotfix/789-urgent → [#789] your messagePrevents direct commits to protected branches:
main, master, developSupports custom rules and remote configuration inheritance.
Create .commithelperrc.json in your project root:
{
"protect": ["main", "master", "develop", "staging"],
"rules": {
"feature": null,
"bugfix": null,
"hotfix": null,
"qa": "naverpay/qa-issues",
"docs": "naverpay/documentation"
}
}
protect (array)List of branch names to protect from direct commits.
["main", "master", "develop"]rules (object)Mapping of branch prefixes to repository names.
"feature")null for current repoextends (string)URL to inherit configuration from:
{
"extends": "https://raw.githubusercontent.com/naverpay/standards/main/.commithelperrc.json"
}
git checkout -b feature/NP-1234-payment-integration
git commit -m "Implement payment gateway"
# Result: [#1234] Implement payment gateway
With configuration:
{
"rules": {
"qa": "naverpay/qa-tracker"
}
}
git checkout -b qa/789-test-payment-flow
git commit -m "Add E2E tests for payment"
# Result: [naverpay/qa-tracker#789] Add E2E tests for payment
git checkout main
git commit -m "Direct commit"
# Error: ❌ Direct commits to protected branch 'main' are not allowed!
# Please create a feature branch and use pull request.
If you prefer Lefthook over Husky:
# lefthook.yml
commit-msg:
scripts:
'commit-helper':
runner: npx --yes @naverpay/commit-helper@latest {1}
For commit message validation in CI:
# .github/workflows/pr.yml
- name: Validate commit messages
run: |
git log --format=%s origin/main..HEAD | while read msg; do
if ! echo "$msg" | grep -qE '^\[[#A-Za-z0-9-/]+\]'; then
echo "Invalid commit message: $msg"
exit 1
fi
done
npx @naverpay/commit-helper <commit-msg-file>
commit-msg-file (string): Path to commit message file (provided by git hook)Q: Does it work with existing issue tags?
A: Yes, if your commit message already contains a tag like [#123], commit-helper will skip it.
Q: Can I use multiple issue numbers?
A: The branch name supports one issue number, but you can manually add more in your commit message.
Q: What branch name formats are supported?
A: Any format with a number after slash: feature/123, feature/123-description, feature/123_description
Q: How to temporarily bypass protection?
A: Use --no-verify flag: git commit --no-verify -m "Emergency fix"
ls -la .husky/commit-msgnpx husky install.commithelperrc.json (note the dot)MIT No newline at end of file
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.