Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
eslint-summary
Advanced tools
Minimal ESLint formatter (reporter) that displays only one summary line.
##A minimal ESLint custom formatter (reporter) that displays one summary line for all files processed.
A minimal ESLint custom formatter (reporter) that displays one summary line for all files processed. The summary line shows the number of files processed, the number of files passed linting (no errors or warnings) and the number of warning and/or errors (if there were any). Use this formatter when you simply want to verify the overall lint status of your project on Git pre-push, etc.
$ npm install --save-dev eslint-summary
Use it with:
$ eslint --format node_modules/eslint-summary/summary.js *.js
grunt.initConfig({
eslint: {
options: {
format: require('eslint-summary')
},
target: ['*.js']
}
});
grunt.loadNpmTasks('grunt-eslint');
grunt.registerTask('default', ['eslint']);
This extension has been tested and confirmed to work with ESLint versions 0.18.0 and later.
See the change log file for more details.
I use Semantic Versioning to number releases. Each release is tagged with the appropriate version number and signed using Gnu Privacy Guard (GPG). The public key used to sign releases is
Name: David Waterston
Email: david@davidwaterston.com
Key ID: A7AD9C85
Signature: 71A9 DC13 447A 1E4F C6EB 5D64 DE08 A991 A7AD 9C85
This public key is included in the repository with a SHA1 of 16d013451476fa4a1a67d6ad4b90583e205b53b1.
After cloning the repo, and assuming you have GPG installed correctly, you can import this key into your keychain
git cat-file blob pubkey | gpg --import
When this public key is successfully imported, you can use it to verify the integrity of any of the tagged releases of this repo
git tag -v v1.0.0
which should produce output similar to:
object 04f37a55784c1f3abc2cf927a935a488aa954035
type commit
tag v1.0.0
tagger David Waterston <david@davidwaterston.com> 1427387056 +0000
Initial commit
This is just an example so don't get fixated on the details, what matters is the signature!
gpg: Signature made Thu 26 Mar 16:24:16 2015 GMT using RSA key ID A7AD9C85
gpg: Good signature from "David Waterston <david@davidwaterston.com>" [ultimate]
The important thing to notice here is that the RSA key ID matches mine (A7AD9C85) and the line that says that this is a good signature.
The public key can further be verified by checking the details held on pgp.mit.edu.
Copyright (c) 2015 David Waterston. All rights reserved.
Distributed under an MIT license. See the LICENSE file for more details.
FAQs
Minimal ESLint formatter (reporter) that displays only one summary line.
We found that eslint-summary demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.