
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
commit-status
Advanced tools
Simple command-line application to post commit status to GitHub (for use in CI)
A simple CLI tool to post commit statuses to GitHub from CI.
At Taskworld, we want to have fine-grain status report for each commit. This is a perfect use case for GitHub’s commit status API.
commit-status will look for GitHub access from these environment variables, in this order:
GH_STATUS_TOKENGH_TOKENThat token should have repo:status scope.
You can create a bot account and obtain a token at https://github.com/settings/tokens/new.
Inside your CI deps script, install commit-status there:
npm install -g commit-status
Whenever you want to post a commit status from CI, invoke the command:
commit-status <state> <context> <description> [<url>]
state — Either pending, success, error, failurecontext — “A string label to differentiate this status from the status of other systems.”description — “A short description of the status.”url — The URL to display.Example CircleCI setup:
- |
if gulp lint
then commit-status success lint/eslint "Linting successful."
else commit-status failure lint/eslint "There are lint errors."
fi
const commitStatus = require('commit-status')
commitStatus.post({
state: 'success',
context: 'lint/eslint',
description: 'Linting successful.'
})
FAQs
Simple command-line application to post commit status to GitHub (for use in CI)
The npm package commit-status receives a total of 163 weekly downloads. As such, commit-status popularity was classified as not popular.
We found that commit-status demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.