
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@ottofeller/dangerules
Advanced tools
The set of Danger.js rules commonly applied in OttoFeller.
The following rules are included in the package:
bump-package-versionChecks all paths as input in includePaths parameter and in case of presence of created/edited files requires the version in package.json to be updated. Parameter restrictToBranches defines branches to run the check for.
PS. The rule is intended to be used with PRs to a main/master branch in order to keep the version up to date.
import {bumpPackageVersion} from '@ottofeller/dangerules'
import {danger, fail} from 'danger'
bumpPackageVersion.bumpPackageVersion({
danger,
fail,
includePaths : ['.'],
restrictToBranches: ['main'],
})
common-code-dirRequires common code to be located in the common/ dir:
import {commonCodeDir} from '@ottofeller/dangerules'
import {danger, fail} from 'danger'
commonCodeDir.commonCodeDir({
baseImportPath : `${process.cwd()}/src`,
danger,
extraCommonDirNames: ['/types'],
fail,
includePaths : [`${process.cwd()}/src`],
})
codegen-missingSearches for Hasura migrations in edited files. If present, warns in case of no changes in codegen files and schema.json.
import {hasura} from '@ottofeller/dangerules'
import {danger, warn} from 'danger'
hasura.codegenMissing({
codegenFileExtension: 'ts',
codegenPaths : ['generated'],
danger,
hasuraMigrationsPath: '../hasura/migrations',
schemaPath : 'schema.json',
warn,
})
squash-migrationsSearches for Hasura migrations in edited files. If present, warns if the quantity of migration files is beyond specified limit.
import {hasura} from '@ottofeller/dangerules'
import {danger, warn} from 'danger'
hasura.squashMigrations({
danger,
hasuraMigrationsPath: '../hasura/migrations',
maxMigrationsLimit : 8,
warn,
})
disallow-extension-in-dirsDisallows a file extension in the selected folders and shows a required extension for the files.
import {nextjs} from '@ottofeller/dangerules'
import {danger, fail} from 'danger'
nextjs.disallowExtensionInDirs({
danger,
excludePaths : ['api/', 'types/'],
extension : 'ts',
fail,
includePaths : ['src/'],
requireExtension: 'tsx',
})
nextjs.disallowExtensionInDirs({
danger,
extension : 'tsx',
fail,
includePaths : ['api/', 'types/'],
requireExtension: 'ts',
})
component-has-testsFinds React components within a project (as an index.tsx file within a CamelCase typed folder) and checks them form minimum test coverage. A component shall have __tests__ folder with index.tsx file (or any other if input in testFile parameter). The test file is searched for the following statements:
import {ComponentName} from '../index'describe('... blockimport {react} from '@ottofeller/dangerules'
import {danger, fail} from 'danger'
react.componentHasTests({
danger,
fail,
includePaths: ['src/'],
})
dir-name-restrictionsFor all created/modified files traverses up through all containing folders and requires the following rules to apply:
Additional notes:
memo located in an index.tsx file;__tests__ and __mocks__ folders are ignored.import {react} from '@ottofeller/dangerules'
import {danger, fail} from 'danger'
react.dirNameRestrictions({
danger,
fail,
includePaths: ['src/'],
/*
* The index page of a nextjs app does not follow the rule.
* We cannot use excludePaths here, since the excludePaths would exclude all descendants of a path.
*/
excludeComponents: ['src/pages'],
})
git clone git@github.com:ottofeller/dangerules.git
cd dangerules
npm link
cd test-project
test-project git(dev): npm link dangerules
In the test project, create a new branch, make changes and commit them
Run the danger to check the current branch relative to the dev branch
test-project git(test-branch): npx danger local --dangerfile=./dangerfile.ts -b dev
Now you can make changes in the dangerules, which will be available after running the npm run build. Run npm danger ... in the project again for tests.
FAQs
A set of Danger.js rules common applied in OttoFeller projects.
We found that @ottofeller/dangerules demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.

Research
A malicious package uses a QR code as steganography in an innovative technique.

Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.