
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@shelf/ci-utils
Advanced tools
$ npx -p=@shelf/ci-utils <cmd> [args...]
Set the RELEASE_VERSION to .env file in your project.
Applicable for master branch only.
For example, if you have a git tag v1.0.0 -> 1.0.0.
For other branches it will return latest.
npx -p=@shelf/ci-utils get-git-version
Set the SSM parameter name to .env file in your project.
By default, It would append the ENVIRONMENT to the parameter name.
Yuo can override it by passing the whole parameter name in
/<env>/<param-name> format (allowed envs: prod, staging).
npx -p=@shelf/ci-utils get-ssm-param <env-name> <param-name>
# Given: the /prod/s3_bucket parameter in SSM equals to 'my-prod-bucket' & ENVIRONMENT=prod
npx -p=@shelf/ci-utils get-ssm-param MY_PARAM s3_bucket # /prod/s3_bucket MY_PARAM=my-prod-bucket in .env
npx -p=@shelf/ci-utils get-ssm-param MY_PARAM /staging/s3_bucket # /staging/s3_bucket MY_PARAM=stage_bucket in .env
Retrieves multiple SSM parameters in a single AWS API call and writes them to .env file.
Uses the same parameter name resolution logic as the single parameter version.
npx -p=@shelf/ci-utils get-ssm-params ENV_KEY1=param1 ENV_KEY2=param2 [ENV_KEY3=param3 ...]
# Examples:
npx -p=@shelf/ci-utils get-ssm-params MY_S3_BUCKET=s3_bucket DATABASE_HOST=db_host
npx -p=@shelf/ci-utils get-ssm-params API_KEY=/staging/api_key DB_PASSWORD=db_pass
Sets the NEXT_BASE_PATH to .env file in your project based on the CIRCLE_BRANCH value.
For main branches (master, develop, main) it will ignore the circle branch.
The ci branch is normalized, see the nextjs-base-path.test.js file for details.
npx -p=@shelf/ci-utils set-nextjs-base-path <custom-base-path?>
# Given: CIRCLE_BRANCH=master
npx -p=@shelf/ci-utils set-nextjs-base-path # NEXT_BASE_PATH=
npx -p=@shelf/ci-utils get-ssm-param MY_PARAM read # NEXT_BASE_PATH=/read
# Given: CIRCLE_BRANCH=feature/ADMINAPP-123-feature-description
npx -p=@shelf/ci-utils set-nextjs-base-path # NEXT_BASE_PATH=/feature-ADMINAPP-123
npx -p=@shelf/ci-utils set-nextjs-base-path custom-path # NEXT_BASE_PATH=/custom-path-feature-ADMINAPP-123
# Given: CIRCLE_BRANCH=release/v1.0.0
npx -p=@shelf/ci-utils set-nextjs-base-path # NEXT_BASE_PATH=/release-v1.0.0
npx -p=@shelf/ci-utils set-nextjs-base-path custom-path # NEXT_BASE_PATH=/custom-path-release-v1.0.0
# Later it could be used in circleci/config.yml and next config to allow per-branch deployment
- run: npx -p=@shelf/ci-utils set-nextjs-base-path read
- run: yarn build
- run:
name: deploy to s3
command: |
source .env
aws s3 sync . "s3://$AWS_S3_BUCKET_NAME$NEXT_BASE_PATH" \
// next.config.js
const basePath = process.env.NEXT_BASE_PATH || '/read'; //default value for local development
export default {
basePath: process.env.NEXT_BASE_PATH,
};
$ git checkout master
$ yarn version
$ yarn publish
$ git push origin master --tags
MIT © Shelf
FAQs
CI utils for Shelf projects
The npm package @shelf/ci-utils receives a total of 619 weekly downloads. As such, @shelf/ci-utils popularity was classified as not popular.
We found that @shelf/ci-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 59 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.