
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@owngames/git-cz
Advanced tools
npm i -g git-cz
added 1 package in 0.612s
Installs in 0.6s vs 31.1s.
I needed to customize some things, and seemed like the intent was breaking away from streamich/git-cz.
📝️ Note: @owngames/git-cz-v7.0.0 is the main breaking off point
You can provide a custom configuration in a changelog.config.js file in your repo, or in any parent folder.
git-cz will search for the closest config file.
Using --non-interactive flag you can run git-cz non-interactive mode.
For example:
git-cz --non-interactive --type=feat --subject="add onClick prop to component"
CLI parameters:
--body--breaking--issues--lerna--scope--subject--typeBy default the subject format is: {emoji} {scope} {branchName}{subject}
--format "{emoji} {scope} {branchName}{subject}"
{
"commit": {
"format": "{emoji} {scope} {branchName}{subject}"
}
}
You can configure your own using the following fields:
{branchName}{emoji}{scope}{subject}{type}These are the only fields that will be dynamically replaced by @owngames/git-cz.
These are not ${type} so in your configuration if you need to pass dynamically values to format you can while keeping these separate. Helpful for when adding [skip ci] to format conditionally.
📝️ Note: If your configuration file is dynamic and you want to override these change yours at run time to ${type} 😅️. These fields are only replaced if they exist. Heck, you can have a format of: format: "static(hard): code value" if you really want (please do not).
This is really only useful if you are using an issue tracker like Jira.
▲ git-cz [ABC-1234] git-cz
Would pull ABC-1234 in for {branchName}
If you were doing something like:
▲ git-cz [feature/gitflow-branch-names]
You would not want to pass branchPrefix as that would be a long commit message.
Also most likely if you are doing feature branches you are doing ABC-1234's into it.
From gitmoji:
access: Improve accessibilityanalytics: Add or update analytics or track codeanimation: Add or update animations and transitionsarch: Make architectural changesassets: Add or update assetsbeer: Write code drunkenlybreaking: Introduce breaking changesbuild: Add or update development scriptscatch: Catch errorsci: Add or update CI build systemclean: Deprecate code that needs to be cleaned upcompat: Update code due to external API changesconfig: Add or update configuration filescontrib-add: Add or update contributor(s)data: Data exploration/inspectiondb: Perform database related changesdep-add: Add a dependencydep-rm: Remove a dependencydep-up: Add or update compiled files or packagesdeploy: Deploy stuffdocs: Add or update documentationdocs-code: Add or update comments in source codedowngrade: Downgrade dependenciesegg: Add or update an easter eggexperiment: Perform experimentsfeat: Introduce new featuresfix: Fix a bugfix-ci: Fix CI Buildflags: Add, update, or remove feature flagshotfix: Critical hotfixi18n: Internationalization and localizationignore: Add or update a .gitignore fileinit: Begin a projectiphone: Work on responsive designlicense: Add or update licenselint: Fix compiler / linter warningslog-add: Add or update logslog-rm: Remove logsmerge: Merge branchesmock: Mock thingsmv: Move or rename resources (e.g.: files, paths, routes)patch: Simple fix for a non-critical issueperf: Improve performancepoo: Write bad code that needs to be improvedprune: Remove code or filespushpin: Pin dependencies to specific versionsrefactor: Refactor coderelease: Release / Version tagsrevert: Revert changesrip: Remove dead coderoles: Work on code related to authorization, roles and permissionssecurity: Fix security issuesseed: Add or update seed filesseo: Improve SEOsnapshot: Add or update snapshotsstyle: Improve structure / format of the codetest: Add or update teststexts: Add or update text and literalstypes: Add or update typestypo: Fix typosui: Add or update the UI and style filesupgrade: Upgrade dependenciesux: Improve user experience / usabilitywip: Work in progressCustom additivies:
chore: Changes that don’t modify src or test filerollforward: Create rollforward versionrun-build: Custom type for CI/CD to hook into run build overrideThe subject contains succinct description of the change:
Just as in the subject, use the imperative, present tense: "change" not "changed" nor "changes". The body should include the motivation for the change and contrast this with previous behavior.
Breaking Changes must start with the words BREAKING CHANGE:.
If you are using husky@5.x on your project that has git-cz as a local dependency please be cognizant of locally installed binaries:
If you were calling directly locally installed binaries, you need to run them via your package manager:
npx --no-install git-cz --hook || true
yarn git-cz --hook || true
Change the mode and create branches via gitflow:
git-cz -m branch
This is not going to be great to type, but may be good to move to:
https://github.com/commitizen/cz-cli and create adapter/plugins.
FAQs
git(moji)-cz => conventional commits, gitflow branching
We found that @owngames/git-cz demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.