Security News
tea.xyz Spam Plagues npm and RubyGems Package Registries
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
bb-npm-bot
Advanced tools
Readme
A renovate-like service that works on Bitbucket Server.
npm install -g bb-npm-bot
bb-npm-bot --config=my/path/config.json --token=dXNlcm5hbWU6cGFzc3dvcmQ=
Option | Description | Type | Examples | Default |
---|---|---|---|---|
config | a local or network path for your config file | String | "my/path/config.json" "https://my-custom-server/config.json" | |
token | Your Bitbucket auth token | String | "dXNlcm5hbWU6cGFzc3dvcmQ=" |
npm run docker-build
# the following command assumes env vars BB_CONFIG and BB_TOKEN are set to something like BB_CONFIG=/my/path/config.json and BB_TOKEN=dXNlcm5hbWU6cGFzc3dvcmQ=
npm run docker-run
This is your "config.json" top-level.
{
"endpoint": "https://my-stash-server",
"cachePath": "/override/cache/path",
"user": "my-stash-bot-account",
"repositories": [
// ...
],
"packages": [
"mocha",
// ...
],
"versionHint": "~",
"titleTemplate": "custom {{package}} {{oldRange}} {{newRange}}",
"branchTemplate": "custom_{{package}}_{{oldVersion}}_{{newVersion}}",
"descriptionTemplate": "custom {{package}} {{oldRange}} {{newRange}} {{oldVersion}} {{newVersion}}"
}
This is an item inside the "repositories"
array from above.
{
"project": "my-project",
"name": "my-repo",
"packages": [
"lodash",
// ...
]
}
This is a file called ".bb-npm.js" checked in to the repository.
{
"packages": [
"rimraf",
// ...
]
}
These objects are all merged when determining how to update your project.
Option | Description | Type | Examples | Required | Default |
---|---|---|---|---|---|
endpoint | Your private Stash server | String | "https://my-stash-server" | ✔ | |
cachePath | Provide an alternative cache to clone and update deps | String | "/my/temp/dir" | your OS tmp dir + "bb-npm-bot-cache" | |
user | The user submitting the pull requests. This must match the user from your auth token. | String | "my-bot-account" | ✔ | |
repositories | A list of repositories to watch and their settings | Object | ✔ | ||
packages | A list of packages to watch. Leave blank to watch all. | Array of Strings | "mocha" "lodash" | ||
versionHint | Specify a range. Leave blank to keep the existing range. | String | "" "~" "^" | ||
titleTemplate | Override the title using a template | String | "custom {{package}} {{oldRange}} {{newRange}}" | "{{package}} {{oldRange}} => {{newRange}}" | |
branchTemplate | Override the branch name using a template | String | "custom_{{package}}{{oldVersion}}{{newVersion}}" | "bb/{{package}}_{{newVersion}}" | |
descriptionTemplate | Override the description using a template | String | "custom {{package}} {{oldRange}} {{newRange}} {{oldVersion}} {{newVersion}}" | "test description" | |
project | Name of the project or user. Prefix with "~" if it is a user. | String | "my-project" "~my-user" | ✔ | |
name | Name of the repository | String | "my-repo" | ✔ | |
disabled | Disable processing | Boolean | false |
FAQs
Manage NPM dependencies on Bitbucket
The npm package bb-npm-bot receives a total of 43 weekly downloads. As such, bb-npm-bot popularity was classified as not popular.
We found that bb-npm-bot demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Tea.xyz, a crypto project aimed at rewarding open source contributions, is once again facing backlash due to an influx of spam packages flooding public package registries.
Security News
As cyber threats become more autonomous, AI-powered defenses are crucial for businesses to stay ahead of attackers who can exploit software vulnerabilities at scale.
Security News
UnitedHealth Group disclosed that the ransomware attack on Change Healthcare compromised protected health information for millions in the U.S., with estimated costs to the company expected to reach $1 billion.