
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

This blog post is a good introduction to AraGraph.
AraGraph is a tool to generate nice looking permission graphs for Aragon DAOs. It can take the following inputs:
yaml).The tool generates an UML description for the DAO. Use Plantuml to render it.

install
$ npm install -g aragraph
generate for a live DAO on mainnet
$ aragraph 0x2dE83b50Af29678774D5AbC4a7Cb2a588762f28C --chain-id 1 > dao.plantuml
generate from yaml description
$ aragraph ./examples/company.yaml > dao.plantuml
generate from markdown
$ aragraph ./examples/aragon_company_README.md > dao.plantuml
Render
$ java -jar plantuml.jar dao.plantuml
or open with vscode-PlantUML
AraGraph allows you to template certain apps to enrich them with even more context like available Roles, Methods, static security information. See templates/config.json for details.
You can either provide you own config.json:
$ aragraph 0x2dE83b50Af29678774D5AbC4a7Cb2a588762f28C --config config.json
Or use the config.json provided with this package:
$ aragraph 0x2dE83b50Af29678774D5AbC4a7Cb2a588762f28C --default-config
Example: DAO-Kernel on mainnet

new AragonPermissions().fromDAO(address, chainId).then((aragaph) => {
console.log(aragaph.uml())
process.exit(0)
})
Specification: DAO-Templates/Descriptor

const AragonPermissions = require("./AragonPermissions.js");
console.log(new AragonPermissions().fromYaml('./examples/company.yaml').uml())

const AragonPermissions = require("./AragonPermissions.js");
const input = `
| App | Permission | Grantee | Manager |
|-------------------|-----------------------|---------------|---------|
| Kernel | APP_MANAGER | Voting | Voting |
| ACL | CREATE_PERMISSIONS | Voting | Voting |
| EVMScriptRegistry | REGISTRY_MANAGER | Voting | Voting |
| EVMScriptRegistry | REGISTRY_ADD_EXECUTOR | Voting | Voting |
| Voting | CREATE_VOTES | Token Manager | Voting |
| Voting | MODIFY_QUORUM | Voting | Voting |
| Voting | MODIFY_SUPPORT | Voting | Voting |
| Agent or Vault | TRANSFER | Finance | Voting |
| Finance | CREATE_PAYMENTS | Voting | Voting |
| Finance | EXECUTE_PAYMENTS | Voting | Voting |
| Finance | MANAGE_PAYMENTS | Voting | Voting |
| Token Manager | MINT | Voting | Voting |
| Token Manager | BURN | Voting | Voting |
| Agent | RUN_SCRIPT | Voting | Voting |
| Agent | EXECUTE | Voting | Voting |
| Finance | CREATE_PAYMENTS | Payroll | Voting |
| Payroll | ADD_BONUS_ROLE | EOA or Voting | Voting |
| Payroll | ADD_EMPLOYEE_ROLE | EOA or Voting | Voting |
| Payroll | ADD_REIMBURSEMENT_ROLE | EOA or Voting | Voting |
| Payroll | TERMINATE_EMPLOYEE_ROLE | EOA or Voting | Voting |
| Payroll | SET_EMPLOYEE_SALARY_ROLE | EOA or voting | Voting |
| Payroll | MODIFY_PRICE_FEED_ROLE | Voting | Voting |
| Payroll | MODIFY_RATE_EXPIRY_ROLE | Voting | Voting |
| Payroll | MANAGE_ALLOWED_TOKENS_ROLE | Voting | Voting |
`;
console.log(new AragonPermissions().fromMarkdownTable(input).uml())
FAQs
Visualize your Aragon DAO Templates
We found that aragraph demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.