
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@squiz/dxp-ai-semantic-release-config
Advanced tools
Shared semantic-release configuration for DXP AI Tools
Shared semantic-release configuration for DXP AI Tools repository.
npm install --save-dev @squiz/dxp-ai-semantic-release-config
In your tool's package.json:
{
"release": {
"extends": "@squiz/dxp-ai-semantic-release-config"
}
}
Or create a .releaserc.js:
module.exports = require('@squiz/dxp-ai-semantic-release-config');
RELEASE_STAGEControls which release stage to execute and determines git tag prefix:
feature: Creates alpha prerelease versions with feature-v tag prefixdevelopment: Creates dev prerelease versions with dev-v tag prefixstaging: Creates beta prerelease versions with stg-v tag prefixproduction (or unset): Creates stable versions with v tag prefixNPM_CONFIG_TAGControls the npm dist-tag for publishing:
alpha: Feature/alpha dist-tagdev: Development dist-tagstg: Staging dist-taglatest: Production dist-tag (default)| Environment | Branch | RELEASE_STAGE | NPM_CONFIG_TAG | Git Tag Format | Version Example | Use Case |
|---|---|---|---|---|---|---|
| Feature | feature/* | feature | alpha | feature-v${version} | feature-v1.0.0-alpha.1 | Feature branch testing |
| Development | develop | development | dev | dev-v${version} | dev-v1.0.0-dev.5 | Development environment |
| Staging | main | staging | stg | stg-v${version} | stg-v1.0.0-beta.1 | Pre-production testing |
| Production | main | production | latest | v${version} | v1.0.0 | Production releases |
Different tag prefixes prevent conflicts between environments:
feature-v1.0.0-alpha.1dev-v1.0.0-dev.5stg-v1.0.0-beta.1v1.0.0This allows semantic-release to track releases independently across all environments.
staging:publish-tools:
stage: staging-deploy
variables:
RELEASE_STAGE: staging
NPM_CONFIG_TAG: stg
script:
- npm run publish-tools
production:publish-tools:
stage: production-deploy
variables:
RELEASE_STAGE: production
NPM_CONFIG_TAG: latest
script:
- npm run publish-tools
This config uses conventional commits for version bumping:
| Commit Type | Release Type | Example |
|---|---|---|
feat: | minor | feat: add new validation rule |
fix: | patch | fix: correct schema validation |
docs: (with README scope) | patch | docs(README): update examples |
refactor: | patch | refactor: simplify error handling |
style: | patch | style: format code |
test: | patch | test: add unit tests |
BREAKING CHANGE: | major | Any commit with BREAKING CHANGE: in body |
Both staging and production can run on main branch without conflicts:
1. Push to main → Both pipelines trigger
2. Staging runs first:
├─ RELEASE_STAGE=staging
├─ Creates version: 1.0.0-beta.1
├─ Creates tag: stg-v1.0.0-beta.1
├─ Publishes: npm publish --tag stg
└─ Success ✅
3. Production runs later:
├─ RELEASE_STAGE=production
├─ Ignores stg-v* tags
├─ Creates version: 1.0.0
├─ Creates tag: v1.0.0
├─ Publishes: npm publish --tag latest
└─ Success ✅
No conflict! Different tag prefixes keep them separate.
This config works with any npm-compatible registry. Registry configuration should be set in .npmrc:
# GitLab Package Registry
@squiz-ai-tool:registry=https://gitlab.squiz.net/api/v4/projects/17893/packages/npm/
//gitlab.squiz.net/api/v4/projects/17893/packages/npm/:_authToken=${CI_JOB_TOKEN}
ISC
FAQs
Shared semantic-release configuration for DXP AI Tools
We found that @squiz/dxp-ai-semantic-release-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 74 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.