
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Lint faster by only running linters and other tools on files that have recently changed or files that are different from `master` in git.
Lint faster by only running linters and other tools on files that have recently changed or files that are different from master
in git.
npm install -g fastlint
v1.1.0
: added --staged
filter, added support for cwd-relative globs.fastlint --status
Runs fastlint
and shows the current set of filters (in stderr).
fastlint --status --print0 | xargs -0 eslint
Run eslint
on all modified files in the working copy.
fastlint --status --print0 --working-copy HEAD~5 HEAD | xargs -0 eslint
Run eslint
on all files changed in the working copy and in the last five commits in this branch.
fastlint origin/master HEAD | xargs -0 eslint
Run eslint
on all files changed compared to the origin/master
branch.
fastlint --status --print0 --glob '{src,tests}/**/*.{js,jsx}' origin/master HEAD | xargs -0 eslint
Run eslint
on all .js
and .jsx
files in src/
or tests/
changed compared to the origin/master
branch.
Here is an example of a full integration inside package.json
, runnable via npm run-script fastlint
:
"scripts": {
"fastlint": "fastlint --status --print0 --glob '{src,tests}/**/*.{js,jsx}' --glob './webpack*.js' --working-copy --diff-filter=buxq origin/master HEAD | xargs -0 eslint --cache --fix --ext js,jsx || exit 0"
},
--glob [glob]
. Use a glob to filter the results. Can be specified multiple times. The matching is processed using multimatch, see their docs for details. You can use ./{glob}
to specify that the glob should match local files (since v.1.1.0
)
--working-copy
. fastlint
can also include files in the working copy, e.g. files that have been added/modified but not necessarily staged. For UX reasons this gets set if you don't pass anything in (because otherwise there would be nothing to show if you don't pass two branches to compare).
To only include untracked files, use --diff-filter=Q
. To only include tracked files, use --diff-filter=q
.
--diff-filter [(A|C|D|M|R|T|U|X|B|Q)]
. Only select files that are Added (A), Copied (C), Deleted (D), Modified (M), Renamed (R), have their type (i.e. regular file, symlink, submodule, …) changed (T), are Untracked (Q), Unmerged (U), are Unknown (X), or have had their pairing Broken (B). Any combination of the filter characters (including none) can be used.
Also, these upper-case letters can be downcased to exclude. E.g. --diff-filter=ad
excludes added and deleted paths.
Note that "Deleted" does not necessarily mean the file was deleted - it may refer to the file being only modified by deleting lines.
--staged
. Filter files by their staging status. Defaults to not applying any filtering. To select unstaged files, use --no-staged
. This only applies to files in the working copy, since any committed files are considered staged.
Imagine you run git status
. Here's how the output maps to the two filters:
diff-filter | staged | |
---|---|---|
"Changes to be committed" | q (any, not untracked) | staged |
"Changes not staged for commit" | q (any, not untracked) | no-staged |
"Untracked files" | Q (untracked) | no-staged |
--status
logs out the list of selected files to stderr
.
--delimiter [character]
. Join the filenames using this delimiter. \n
, \t
, \r
and \0
are converted to the appropriate character. Default:
.--print0
. Same as --delimiter '\0'
.--paths cwd
. Output paths relative to CWD. Default.--paths full
. Output full paths.--paths gitroot
. Output paths relative to the location of the closest .git
folder, searching up from the current working directory.FAQs
Lint faster by only running linters and other tools on files that have recently changed or files that are different from `master` in git.
The npm package fastlint receives a total of 7,449 weekly downloads. As such, fastlint popularity was classified as popular.
We found that fastlint demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.