Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@vighnesh153/github-gist
Advanced tools
[![npm (scoped)](https://img.shields.io/npm/v/@vighnesh153/github-gist)](https://www.npmjs.com/package/@vighnesh153/github-gist) [![npm bundle size (scoped)](https://img.shields.io/bundlephobia/minzip/@vighnesh153/github-gist)](https://img.shields.io/bund
A simple wrapper over the GitHub's REST API to play with GitHub Gists.
npm install @vighnesh153/github-gist
To interact with the gist in your GitHub account, you need to create a Personal Access Token with the gist scope.
GET
API to fetch the content of a file in a gist, is
CORS protected. If you are using this library on a browser, then you will get CORS blocked. To prevent that, I have
added a default CORS proxy server configuration https://corsanywhere.herokuapp.com/
. But, it is not a good idea to
use this default in production because it probably isn't reliable. The owner might decide to shut it down anytime. So,
I recommend you to build/host your own proxy or opt in for a more reliable one. Following are some helpful links (I
found these options via a quick google search and these are just to get you started and not my recommendations):
In Typescript / ES Modules
import { GithubGist } from '@vighnesh153/github-gist';
In Javascript or CommonJS
const { GithubGist } = require('@vighnesh153/github-gist');
Directly as a script tag (UMD modules)
<!--More on JS Deliver: https://www.jsdelivr.com/-->
<script src="https://cdn.jsdelivr.net/npm/@vighnesh153/github-gist@0/dist/umd.js"></script>
<script>
const GithubGist = GithubGistUmd.GithubGist;
// rest of the code below
</script>
const gist = new GithubGist({
// Required
personalAccessToken: '<GITHUB_PERSONAL_ACCESS_TOKEN>',
// Required. This will be used to identify and connect to your gist among all your other gists.
appIdentifier: 'my-first-gist',
// --- OPTIONAL PARAMS BELOW ---
// Since the gist is also commit based, we can cache the GET urls because git guarantees that
// if the content changes, its SHA will also change which will lead to a new URL for latest content
// If you have lot of gists and you think that caching all the files will be heavy, you can disable
// caching by setting it to false
enableRequestCaching: true,
// Whether the Gist will be a public gist or a secret gist. Note that secret gists are still
// accessible via URLs
isPublic: false,
// Content GET url is CORS protected and we cannot use it directly on the frontend. So, by default,
// we add a Proxy configuration to bypass CORS protection
//
// If you are running this on a server/backend, you can set it to `{ type: 'none' }`
//
// If you want to configure CORS manually, you can use the third type:
// `{ type: 'custom', customRequestConfig: (url) => AxiosRequestConfig }`
//
corsConfig: { type: 'default' },
});
This will create the gist, if it doesn't exist. If the gist already exists, it will just fetch its metadata. This should be the first thing you do and should only be invoked once.
await gist.initialize();
A gist can have multiple files. To create a file, do the following:
You can only store string content in a file. So, if you are creating a JSON file, remember to stringify the content
const pikachuJson = gist.createNewFile('pikachu.json');
console.log(pikachuJson.content);
// ''
pikachuJson.content = JSON.stringify({ message: 'Pikachu is the best' });
console.log(JSON.parse(pikachuJson.content));
// { message: "Pikachu is the best" }
Just creating the file won't save it on your Gist. To save, you will have to invoke the save()
method on it
// This will save the file on the Gist
await pikachuJson.save();
If you have multiple new files or modified files, you can invoke save()
on the gist itself to save all the files in a
single HTTP request
const pikachuPython = gist.createNewFile('pikachu.py');
pikachuPython.content = `print("Pikachu is the best")`;
const pikachuJs = gist.createNewFile('pikachu.js');
pikachuJs.content = `console.log("Pikachu is the best")`;
// Saves all files in a single request
await gist.save();
You can access the previously created file by doing the following
const existingPikachuJson = gist.getFileByName('pikachu.json');
Alternatively, you can also use createNewFile
which will return the existing file, if it exists, else, create it and
return it.
const existingPikachuJson = gist.createNewFile('pikachu.json');
const files = gist.files;
const ownerLogin = gist.owner;
Gist is an awesome way to store small amount data without having to spin up a database. But it does come with some caveats.
save
requests are force
pushes, and you could
overwrite other thread's changessave
in parallel. Wait for the previous Promise
to resolve completely before starting the next one.FAQs
A simple promise-based wrapper over the GitHub's REST API to play with GitHub Gists.
The npm package @vighnesh153/github-gist receives a total of 726 weekly downloads. As such, @vighnesh153/github-gist popularity was classified as not popular.
We found that @vighnesh153/github-gist demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.