Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Keep your technical debt under control.
Check out our blog post to learn more about the concept behind this tool. Bumbailiff works on any git repository.
There are several ways of installing and running bumbailiff.
If you have Node.js and NPM installed, you can use npx
to execute bumbailiff:
npx bumbailiff
You can add bumbailiff to your Node.js project:
npm install --save-dev bumbailiff
Or alternatively:
yarn add --dev bumbailiff
Download and decompress the archive of this repository in the directory of your choice:
curl -LO https://github.com/SmartBear/bumbailiff/archive/main.zip
unzip main.zip
Add the location of the bumbailiff-main/src
dir to your $PATH
.
bumbailiff 10
This will check that you git repository does not contain more than 10 days of accumulated TODO-days. To do so, bumbailiff will query your git repository and search for all the TODOs it can find, compute the age of each one and print out the sum.
The maximum debt age is optional and defaults to 14.
After installing bumbailiff, you might want to set up a pre-push hook in your repository to prevent pushing if the tech debt limit has been reached:
echo "#\!/usr/bin/env bash\nbumbailiff" >> .git/hooks/pre-push && chmod +x .git/hooks/pre-push
At Cucumber and Smartbear, we also use other tools that make our software development practices as a (remote) mob more healthy:
This project is based off the original work of Aslak Hellesøy. Some of the bash work around bumbailiff was also inspired by Steve Tooke's retro-tools who was himself inspired by Nat Pryce's work.
FAQs
Keep your technical debt under control.
The npm package bumbailiff receives a total of 117 weekly downloads. As such, bumbailiff popularity was classified as not popular.
We found that bumbailiff demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.