
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
action-status
Advanced tools
action-status makes it easy to create check statuses in GitHub Actions.
Currently, each action in a GitHub Actions workflow has its status set automatically, and you can't change anything useful about the status (such as its short textual description or "Details" link URL) because it'll be overwritten when the action is resolved in the workflow. action-status makes it easy to create separate status checks with a unique name that can include more useful information, for instance:
There are three different ways to use it:
You can install action-status via npm with:
npm install --save --dev action-status
Then, in your package's run-scripts you can call it via action-status, e.g. if you publish to npm from Actions, you could do this:
{
"scripts": {
"prepublish": "action-status --context=\"publish $npm_package_name\" --state=pending --desc=\"Publishing $npm_package_version...\"",
"postpublish": "action-status --context=\"publish $npm_package_name\" --state=success --desc=\"Published $npm_package_version\"",
},
"devDependencies": {
"action-status": "1.0.0"
}
}
:warning: Warning: npm is run as root in GitHub Actions, which means that pre- and post- lifecycle scripts will not be run unless you explicitly call npm with the --unsafe-perms option. Be warned, though, that this makes it possible for any of your dependencies to run (in a preinstall script, for instance) arbitrary commands with access to your secrets, source, and git history.
Using npm's npx command allows you to run action-status without explicitly declaring it as a dependency in your package.json:
npx action-status --context=ping --state=success
Note: This is really only useful if you're running it once, though, since npx will reinstall the package each time you call it.
You can call the action-status command via an action with:
action "status" {
uses = "shawnbot/action-status@master"
args = ["--context=ping", "--state=success"]
secrets = ["GITHUB_TOKEN"]
}
Note: You must enable the automatic GITHUB_TOKEN secret unless you're going to provide a different access token via --token=$SOME_OTHER_SECRET
FAQs
Easily create commit statuses from GitHub Actions
We found that action-status demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.