
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@segersniels/gitmoji
Advanced tools
[](https://github.com/segersniels/gitmoji/actions)[](https://www.npmjs.com/package/@segersniels/gitmoji)
This project provides an easy solution for using gitmoji from your command line. Gitmoji solves the hassle of searching through the gitmoji list! 🎉
A simplistic interpretation of the carloscuesta/gitmoji-cli repository with only basic commit functionality.
Usage: gitmoji [options] [command]
A gitmoji client for using emojis on commit messages.
Options:
-V, --version output the version number
-h, --help display help for command
Commands:
commit [options] Interactively commit using the prompts
update Sync emoji list with the repo
list List all the available gitmojis
config Configure general gitmoji behaviour
help [command] display help for command
You can generate commit messages based on your current staged changes by passing the --generate flag to the commit command.
gitmoji commit --generate
To use the latest model (GPT-4 at time of writing) simply enable it in the config using gitmoji config enable. By default gitmoji uses the gpt-3.5-turbo model.
Keep in mind that you will need to set the
OPENAI_API_KEYenvironment variable which you can obtain through the OpenAI website.
Configure global gitmoji settings through an easy prompt selection.
Usage: gitmoji config [options] [command]
Configure general gitmoji behaviour
Options:
-h, --help display help for command
Commands:
enable Enable behaviour
disable Disable behaviour
list|ls View the current config
help [command] display help for command
To disable automatic capitalization of the first character of your commit message:
$ gitmoji config disable
? Choose an option to disable ›
❯ capitalize-first-letter
FAQs
[](https://github.com/segersniels/gitmoji/actions)[](https://www.npmjs.com/package/@segersniels/gitmoji)
We found that @segersniels/gitmoji demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.