
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@saji/git-hooks
Advanced tools
Zero config, opinionated git hooks that you can drop into your project and it will just work™.
If there’s EsLint config, will lint your files, if there’s test npm
script will run it on push, if commit lint config, will check your
commit messages etc, etc, etc. For full list of hooks, see files in
*.d directories.
Install hooks as a dependency in your project:
npm install --save-dev @saji/git-hooks
Install hooks package globally:
npm install -g @saji/git-hooks
Install it in any repository you want:
git install-hooks
Add -f to force overwriting any existing hooks.
Clone this repository somewhere
In your repository run:
SOMEWHERE/install.sh`
hooksPathClone this repository somewhere
In your repository run:
git config core.hooksPath SOMEWHERE
You could use --global to set it up for all your repositories.
git config --type=int hooks.$HOOK_NAME.enabled false
# e.g. hooks.npm-test.enabled
You can also disable a hook for single run, e.g.
git -c hooks.npm-test.enabled=false push
As a shorthand you can omit .enabled:
git -c hooks.npm-test=false push
Apart from passing --no-verify you can also use hooks.enabled
config option.
git config --type=int hooks.verbosity 2
set -xnpm-testHook detects if jest is being used for testing and if so, only runs tests that are related to modified files, but that heuristic is not perfect. You can force selected files to always be included, e.g.
git config hooks.pre-push.npm-test.forcedJestTests tests/storybook.test.js
branch-nameWhen configured with a extended grep regular expression will check if branch names match it, e.g.
git config hooks.pre-push.branch-name.allow-regexp '^((feat|fix|doc|chore)/|production$)'
You don’t have to list your main branch.
Licensed under ISC.
FAQs
Set of common git hooks
We found that @saji/git-hooks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.