
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
changed-log
Advanced tools
Returns all commit messages between 2 versions of an NPM module
npm install -g changed-log
What has changed for module 'chalk' between version 0.3.0 and 0.5.1?
$ changed-log chalk 0.3.0 0.5.1
found 30 commits finishing with the latest commit 994758f
Changelog for module chalk repo chalk/chalk from 0.3.0 to 0.5.1
0.5.1
994758f: 0.5.1
ca250ab: Merge pull request #33 from seanmonstar/_styles
7ef6f4c: dont use slice on arguments
4291833: return a new function for each getter
0.5.0
3073fa3: 0.5.0
af17529: use rawgithub to workaround npm website bug with relative image paths
3ab833d: bench - increase iterations for more reliable results
...
0.4.0
0a33a27: 0.4.0
...
15f928f: Update readme
The information is fetched from the github repo corresponding to the NPM package. Alternatively you can provide github username / repo instead of NPM package name
$ changed-log kensho/ng-describe 0.3.0 0.5.0
For private repos, you can authenticate one time (including 2Factor) by passing commandline
option --auth
with the command
To find all changes between a module and the latest release use the command
$ changed-log <name> <from> latest
$ changed-log pre-git 1.2.0 latest
If you only provide a single version from a folder that contains package.json
it will read the 'from' version from the the package.json
, assuming you have only
provided the 'to' version
$ changed-log <name> <to>
# reads name "from" version in the package.json
If you do not provide any version information, it tries to read 'from' version
in the package.json
and uses latest
for 'to' version
$ changed-log <name>
# shows list of commits between the current version in package.json and latest
You can use changed-log
as a module from your application.
var changedLog = require('changed-log');
// exports single function
changedLog(options, reportingOptions);
/*
options = {
auth: true | false - ask user to authenticate, optional
name: <string> - package name OR <github username/repo name> to go directly to Github
from: <string> - first tag
to: <string> - second tag
},
reportingOptions = {
details: true | false - prints the full commit message if true, otherwise just first line
}
*/
The changedLog
function returns a promise, resolved after report printing is complete.
The promise is resolved with an instance of Report
, see src/report.js
If something is not working, you can see verbose log output, just run the program
with DEBUG=changed
environment variable set
DEBUG=changed changed-log ...
Author: Gleb Bahmutov © 2015
License: MIT - do anything with the code, but don't blame me if it does not work.
Spread the word: tweet, star on github, etc.
Support: if you find any problems with this module, email / tweet / open issue on Github
Copyright (c) 2015 Gleb Bahmutov
Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
FAQs
Returns all commit messages between 2 versions of an NPM module
The npm package changed-log receives a total of 399 weekly downloads. As such, changed-log popularity was classified as not popular.
We found that changed-log demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.