Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@prototyp-stockholm/contentful-migrator-programme
Advanced tools
Tool to manage and keep track of contentful migrations.
Tool to manage Contentful migrations
npm i --save @prototyp-stockholm/contentful-migrator-programme
Get an API Key for migrations (CTF_CMA_TOKEN
) under Settings -> API Keys -> Content management
tokens in your Contentful space.
Create an environment under Settings -> Environments
.
Create a .env
file in your project root and add these variables:
CTF_SPACE_ID=<SECRET> # The Contentful space id
CTF_ENVIRONMENT_ID=<SECRET> # The name of the Contentful environment
CTF_CMA_TOKEN=<SECRET> # The Content Management API token
MIGRATIONS_DIR=migrations # A relative path to the directory where CMP will store migration script files
APPLIED_MIGRATIONS_TYPE_ID=appliedMigrations # The content type id used to store applied migration entries
MAX_NUMBER_OF_ALIASES=1 # The number of allowed aliases in this Contentful space
MAX_NUMBER_OF_ENVIRONMENTS=4 # The number of allowed environments in this Contentful space
NUMBER_OF_RETRIES_WHEN_CREATING_ENVIRONMENT=10 # Number of retries when creating an environment
An example migration with up
and down
functions:
module.exports.up = (migration, context) => {
const dog = migration.createContentType('dog').name('Dog').displayField('name')
dog.createField('name').type('Symbol').name('Name')
}
module.exports.down = (migration, context) => {
// Note: If you already have content with type dog you'll have to remove all dog entries, before removing the dog type
migration.deleteContentType('dog')
}
If you did not install the package globally you'll have to prepend node_modules/.bin/
to the cmp
command.
Otherwise, you can add the cmp
command in the scripts section of the project package.json
.
Then you can use it like so: npm run cmp
.
{
"scripts": {
"cmp": "cmp"
}
}
Read more on migration syntax on https://github.com/contentful/contentful-migration
cmp generate <migrationName>
Generates a migration with the given name and a timestamp prepended ex: YYYYMMDDhhmmssxxx-add-user-type.js.
cmp migrate
Applies all up operations of the non applied migrations to the CTF_ENVIRONMENT_ID set in the .env
file
cmp rollback
Applies the down operations (i.e rolls back ) of the latest migration batch
cmp aux:create <name?>
Creates an aux environment based on CTF_ENVIRONMENT_ID. You can give it an optional name.
cmp aux:drop <name>
Drop the environment with the given name
cmp aux:test
Creates environment from CTF_ENVIRONMENT_ID, applies new migrations, and drops the environment
npm i
npm link
npm init
npm i @prototyp-stockholm/contentful-migrator-programme
npm link @prototyp-stockholm/contentful-migrator-programme
Now anything you modify in the locally cloned package will be instantly available in the test project to test.
npm run m:generate add-name-to-user-type --name=Symbol --age=Number
for example and generate the needed code to add the fields.Release-please is utilized to simplify releases and to auto-publish on NPM. In short, release-please creates a release-PR that updates the version and edits the Changelog as soon as it detects new commits with messages starting with "fix" or "feat". This PR is maintained until it is merged. Upon merging, this packages is released and once done it auto-publishes on NPM.
Read more here https://github.com/google-github-actions/release-please-action#how-release-please-works
FAQs
Tool to manage and keep track of contentful migrations.
The npm package @prototyp-stockholm/contentful-migrator-programme receives a total of 50 weekly downloads. As such, @prototyp-stockholm/contentful-migrator-programme popularity was classified as not popular.
We found that @prototyp-stockholm/contentful-migrator-programme demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.