
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@umbrellio/gbot
Advanced tools
Gitlab bot platform.
$ yarn add @umbrellio/gbot
or
$ npm i @umbrellio/gbot
unapproved
Sends unapproved MRs to mattermost / slack. MR will be ignored if it has Draft
/WIP
mark.
$ gbot unapproved -c /path/to/config/gbot.yaml
Each setting can be set via environment variables.
Each variable must start with GBOT_
prefix. Double underscore is interpreted as nesting, for example:
GBOT_GITLAB_TOKEN=token # { "gitlabToken": "token" }
GBOT_GITLAB__TOKEN=token # {"gitlab": { "token": "token" } }
Example of the config file:
messenger:
url: "<chat.postMessage URL>" # Slack chat.postMessage endpoint
token: "<TOKEN>" # Slack token with chat:write scope
channel: "<CHANNEL>" # Mattermost / Slack channel where will be messages sent
markup: "slack" # Messenger markup (default - "markdown").
# Possible values:
# - "markdown" (for Mattermost)
# - "slack" (for Slack)
sender:
username: "@umbrellio/gbot" # Sender's display name
icon: "<icon url>" # Sender's icon url
slack:
usernameMapping:
pavel: "U020DSB741G" # Mapping of Gitlab username to Slack ID
gitlab:
token: "<TOKEN>" # GitLab Private Access Token
url: "<gitlab api url>" # Gitlab API base url
groups: # List of your project’s groups (optional if projects are defined)
- id: 4 # Group id
excluded: [1, 2, 3] # List of projects to exclude from the current group projects (optional)
- id: 5
projects: # List of your project (optional if groups are defined)
- id: 42 # Project id
paths: # List of paths that should be changed in merge requests
- src/**/*
- id: 43
# tasks config
unapproved: # Config for `unapproved` command
emoji: # Emoji which will be set for each MR (optional)
24h: ":emoji1:" # If MR's last update time more than 24 hours
# Time interval can be set in seconds, minutes,
# hours and days (30s, 10m, 5h, 2d)
12h: ":emoji2:" # If MR's last update time more than 12 hours
default: ":emoji3:" # Default emoji (if other ones wasn't matched)
tag: # Specify who will be tagged in messenger
approvers: false # Tag approvers or not (default - false)
author: false # Tag author of PR or not (default - false)
commenters: false # Tag thread commenters or not (default - false)
onThreadsOpen: false # Whether to tag thread authors and PR author when threads are present
onConflict: false # Whether to tag PR author if there are conflicts
diffs: false # Show changed lines count or not (default - false)
splitByReviewProgress: false # Whether to split the requests into those completely without review, those that under review and those with conflicts
requestsPerMessage: 15 # Merge requests count per message
checkConflicts: false # Whether to check PR conflicts
Groups in the config are Gitlab project groups. You must specify the group or the project, or both.
Bug reports and pull requests are welcome on GitHub at https://github.com/umbrellio/gbot.
Released under MIT License.
Created by Aleksei Bespalov.
FAQs
Gitlab bot platform.
The npm package @umbrellio/gbot receives a total of 0 weekly downloads. As such, @umbrellio/gbot popularity was classified as not popular.
We found that @umbrellio/gbot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.