
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
This is an app to poll a bitbucket branch for PRs. When the PRs are found, it looks for changes from the last poll. If there are changes, it will create a message in a Flowdock flow. If the PR is ready to merge and someone has left the comment "mab", the PR will be merged.
We were having issues with being ready to merge a PR, but having to remember to come back to it if a build was in progress. Our builds can take 10s of minutes, and often PRs would linger until they were caught at just the right time when builds were complete (builds get spawned for every merge, so there are lots of builds going on). By having a process that polls the PRs looking for the comment "mab", we can let autobit merge when the PR is ready.
Also, we were getting lots of bitbucket emails, and some of us stopped looking at them. Now we can have major PR changes logged to a flow, which is where many people live these days.
| Parameter | Alias | Default | Description |
|---|---|---|---|
--username | -u | - | You have to log in with your credentials to authenticate against bitbucket. you can pass your username here |
--password | -p | - | Bitbucket password - if not specified you'll be prompted |
--branch | -b | - | The branch you want to poll (ex. refs/heads/foo/bar) can be multiple branches (ex. refs/heads/foo/bar refs/heads/bam/baz) |
--flowdockToken | -f | - | The api token to use to authenticate to flowdock |
--bitbucketBaseUrl | -l | - | The base url to your bitbucket instance (ex. https://bitbucket.foo.com/rest/api/1.0) |
--proxyBypass | -y | - | Addresses you don't want going through whatever proxy you have (i have a no_proxy export, but it doesn't seem to get honored by the library i'm using) (ex. foo.com) |
--proxyUrl | -x | '' | The url to your proxy, if any |
--flowName | - | - | The name of the flow to post to (ex. 'Myflow for automation') |
--repository | - | - | The repository part of the path, (ex. projects/foo/repos/bar) |
--intervalSeconds | - | 10 | The number of seconds between polling (defaults to 10) |
--flowdockUsername | - | 'autobit' | The name displayed for flowdock automation messages (defaults to autobit) |
--flowdockBlacklist | - | - | Exclude certain usernames from flowdock messaging |
Install autobit with npm i -g autobit
Run autobit from the terminal, ex. autobit -u myusername -b refs/heads/foo/bar -f 2asdfasff232234234234 --bitbucketBaseUrl https://bitbucket.foo.com -flowName 'My automation' -repository projects/foo/repos/bar
If autobit fails due to a 401, authentication failed, the process will exit and an error will be logged to flowdock. This should only happen if your credentials are no longer valid, in which case you'll have to start the process again to enter your password.
"mab" is the comment used to tell autobit you want the PR merged as soon as it's able to be merged
"cancel" is a comment you can put after a "mab" to tell autobit to ignore the previous "mab"
FAQs
bitbucket automation
We found that autobit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.