Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
commit-status
Advanced tools
Simple command-line application to post commit status to GitHub (for use in CI)
A simple CLI tool to post commit statuses to GitHub from CI.
At Taskworld, we want to have fine-grain status report for each commit. This is a perfect use case for GitHub’s commit status API.
commit-status
will look for GitHub access from these environment variables, in this order:
GH_STATUS_TOKEN
GH_TOKEN
That token should have repo:status
scope.
You can create a bot account and obtain a token at https://github.com/settings/tokens/new.
If you use GitHub Enterprise, then you can override the API endpoint by GITHUB_API
environment variable.
env GITHUB_API=https://[hostname]/api/v3 commit-message ...
Inside your CI deps script, install commit-status
there:
npm install -g commit-status
Whenever you want to post a commit status from CI, invoke the command:
commit-status <state> <context> <description> [<url>]
state
— Either pending
, success
, error
, failure
context
— “A string label to differentiate this status from the status of other systems.”description
— “A short description of the status.”url
— The URL to display.Example CircleCI setup:
- |
if gulp lint
then commit-status success lint/eslint "Linting successful."
else commit-status failure lint/eslint "There are lint errors."
fi
const commitStatus = require('commit-status')
commitStatus.post({
state: 'success',
context: 'lint/eslint',
description: 'Linting successful.'
})
FAQs
Simple command-line application to post commit status to GitHub (for use in CI)
The npm package commit-status receives a total of 362 weekly downloads. As such, commit-status popularity was classified as not popular.
We found that commit-status demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.