Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Client for creating and updating CWRC XML documents in GitHub through the GitHub API.
NPM package for searching GitHub, and for creating and updating CWRC XML documents in GitHub, all through the GitHub API. Used by the CWRC-GitServer, whose web API is in turn used by the CWRC-GitWriter.
The CWRC GitHub Sandbox is a running instance of CWRC-GitWriter, which used the NPM package published from this repository along with the code in CWRC-WriterBase, CWRC-GitServer, CWRC-GitDelegator, and CWRC-GitServerClient. The same code is easily (for someone with modest development experience) installed on any server to run your own instance. If you are looking to put together your own CWRC-Writer, CWRC-GitWriter is probably a good place to start.
npm install cwrcgit
To simultaneously register as a dependency in your package.json:
npm install cwrcgit --save
or in shortcut form:
npm i -S cwrcgit
One example:
var cwrcGit = require('cwrcgit'); cwrcGit.authenticate(gitHubOAuthToken); var repos = cwrcGit.getReposForAuthenticatedUser();
The spec directory contains specifications (tests) that can help better understand the API. Also see CWRC-GitServer which fully uses the API.
The methods exposed (API) by this package are:
authenticate(gitHubOAuthToken) - must first be called before any of the other methods
getDetailsForAuthenticatedUser()
getReposForAuthenticatedUser()
getReposForUser({username:gitHubUserNameGoesHere})
createRepoForDoc({
repo: the repository name,
isPrivate: true/false,
doc:the XML document itself,
description: description of the repo/doc,
annotations: bundle of oa annotations as single string of rdf,
versionTimestamp: timestamp which acts as the version number
})
saveDoc({
owner: github username,
repo: repository name,
doc:the XML document itself,
baseTreeSHA: baseTreeSHA,
parentCommitSHA: parentCommitSHA,
annotations: bundle of oa annotations as single string of rdf,
versionTimestamp: timestamp which acts as the version number
})
getDoc({
owner: github username,
repo: github repository name
})
getAnnotations({
owner: github username,
repo: github repository name
})
getTemplates({
owner: github username,
repo: github repository name,
ref: the branch
path: path to template files
})
getTemplate(download_url_from_getTemplates_call)
search({
user: github username (optional)
topics: array of github topics (optional),
query: query terms (required)
})
Fork or clone (depending on your role in the project) the repo to your local machine.
npm install
to install the node.js dependencies
NOTE: we use npm set save-exact true
to save dependencies as exact version numbers so NPM should install exact versions when you run install
The config.js file specifies several passwords and tokens that are used during testing. You'll have to set these values appropriately in your cloned repo. The jwt_secret shouldn't matter, but the github values do. Once you've substituted your values, stop git from noticing that you've changed the file (so that you don't inadvertently commit the file and push it to the public repo thereby exposing the passwords):
git update-index --skip-worktree config.js
write a test (or two)for your new functionality (in 'spec' directory)
npm test
to start mocha and automatically rerun the tests whenever you change a file
change some stuff to satisfy new test
If you are working within a cloned copy, do the following to setup automatic semantic release through continuous integration using semantic-release (which in turn uses Travis) and commitizen. Otherwise, if you are working from a fork, then submit a pull-request.
Make sure you've got NPM configured to publish to the NPM registry:
npm set init.author.name "James Chartrand"
npm set init.author.email "jc.chartrand@gmail.com"
npm set init.author.url "http://openskysolutions.ca"
npm login (answer prompts approriately)
Install semantic-release-cli globally:
npm install -g semantic-release-cli
If necessary (although this was probably already done by someone else, but maybe the NPM author information has changed for example) configure semantic release:
semantic-release-cli setup
which will ask you a series of questions, which at the time of writing this were:
semantic-release-cli setup
? What is your npm registry? https://registry.npmjs.org/
? What is your npm username? jchartrand
? What is your npm password? *******
? What is your GitHub username? jchartrand
? What is your GitHub password? ********
? What CI are you using? Travis CI
Semantic-release-cli configures the corresponding Travis build (on the Travis web site in the Travis account associated with the given Github username) so that when the Travis build is triggered (whenever you push a change to the GitHub repo), Travis will run semantic-release, which will in turn:
A full description of what semantic-release-cli does is here. A full description of what semantic-release itself does is here
To submit a commit, stage your changes (e.g., git add -A) then instead of using git's commit command, instead use npm run commit
which uses commitizen to create commits that are structured to adhere to the semantic-release conventions (which are the same as those used by Google: https://github.com/angular/angular.js/blob/master/CONTRIBUTING.md#commit )
The NPM ghooks
package is used to add two pre-commit git hooks that will check that all mocha tests pass and that code coverage is 100% (as caluclated by istanbul) before allowing a commit to proceed. The hooks are set in package.json:
"config": {
"ghooks": {
"pre-commit": "npm run test:single && npm run check-coverage"
}
}
After the commit has succeeded then git push
it all up to github, which will in turn trigger the Travis build. The Travis build is also set to confirm that all tests pass and that code coverage is 100%. This is set in the .travis.yml
file:
script:
- npm run test:single
- npm run check-coverage
Of course, if the githooks that check tests and code coverage themselves passed, then the Travis check for tests and code coverage should also be fine.
Results of the travis build are here:
https://travis-ci.org/cwrc/CWRC-Git
The Travis build also publishes the code coverage statistics to codecov.io where the coverage can be viewed:
https://codecov.io/gh/cwrc/CWRC-Git/
codecov.io also provides us with the code coverage badge at the top of this README.
Finally the Travis build publishes a new version (if the commit was designated as a new feature or breaking change) to NPM:
https://www.npmjs.com/package/cwrcgit
Testing uses mocha and chai. Tests are in the spec
directory.
This module makes http calls to the GitHub API, including calls to create new repositories. Rather than make those calls for every test, nock instead mocks the calls to GitHub (intercepts the calls and instead returns pre-recorded data).
Please contact us if you'd like to contribute. Standard pull requests, including tests, are expected.
Who would use this?
Anyone wanting to use the CWRC-Writer to author XML documents with RDF annotations, and save those documents to GitHub.
FAQs
Client for creating and updating CWRC XML documents in GitHub through the GitHub API.
The npm package cwrcgit receives a total of 2 weekly downloads. As such, cwrcgit popularity was classified as not popular.
We found that cwrcgit demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.