
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@teamsparta/commitlint-config
Advanced tools
커밋 메시지에 대한 규칙을 검사하기 위해 사용하는 공용 commitlint 설정입니다.
pnpm add -D @teamsparta/commitlint-config @commitlint/cli @commitlint/config-conventional husky
yarn add -D @teamsparta/commitlint-config @commitlint/cli @commitlint/config-conventional husky
루트에 commitlint.config.cjs 파일을 생성하고 아래와 같이 작성함으로서 프로젝트가 이 규칙으로 커밋 메시지를 검사해야 하도록 합니다.
module.exports = {
extends: ['@teamsparta/commitlint-config'],
};
아래 중 하나를 선택해 적용하세요.
grep -q 'commitlint --edit' .husky/commit-msg || printf '\n# commitlint\nnpx --no-install commitlint --edit "$1"\n' >> .husky/commit-msg
chmod +x .husky/commit-msg
printf '#!/usr/bin/env sh\n. "$(dirname -- "$0")/_/husky.sh"\n\nnpx --no-install commitlint --edit "$1"\n' > .husky/commit-msg
chmod +x .husky/commit-msg
먼저 Husky를 초기화하고, commit-msg 훅을 생성합니다.
pnpm dlx husky-init && pnpm install
printf '#!/usr/bin/env sh\n. "$(dirname -- "$0")/_/husky.sh"\n\nnpx --no-install commitlint --edit "$1"\n' > .husky/commit-msg
chmod +x .husky/commit-msg
이제 git commit을 실행할 때마다 Commitlint가 메시지를 검사합니다. 규칙을 어기면 커밋이 실패합니다.
feat, fix, hotfix,chore, docs, refactor,design, style, test# 통과하는 커밋
git commit -m "feat: 로그인 버튼 추가"
# 실패하는 커밋(허용되지 않은 type)
git commit -m "update: 로그인 버튼 추가"
index.js를 참고하세요.commitlint.config.cjs
module.exports = { extends: ['@teamsparta/commitlint-config'] };
.husky/commit-msg
npx --no-install commitlint --edit "$1"
FAQs
Team Sparta's shared commitlint config
The npm package @teamsparta/commitlint-config receives a total of 0 weekly downloads. As such, @teamsparta/commitlint-config popularity was classified as not popular.
We found that @teamsparta/commitlint-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 21 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.