
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
An npm module to simplify writing build artifacts to gcs from your CI environment
CircleCI and TravisCI are currently the only supported platforms, feel free to open a pull request to add another
gcs-ci
will automatically detected your CI environmennt and pull in the necessary environmennt variables to deploy to GCS.
You'll need to provide the following:
GCS_PROJECT_ID
GCS_BUCKET_NAME
GCLOUD_SERVICE_KEY
- if you env has already authorized gcloud
this isn't requiredPIPELINE_NUMBER
- this is required only for circle CI and can be passed via:
PIPELINE_NUMBER=<< pipeline.number >> npm run <gcs-ui command>
gcs-ci
leverages your CI service's environment variables to build a reasonable file prefix as well as includes a manifest describing the job the artifacts were generated from. They're pushed to the GCS bucket provided above. Depending on your platform, artifacts will be stored with the prefix:
<bucket>/<repo>/<branch>/<pipeline number>/<job>/build_<build number>
<bucket>/<repo>/<branch>/build_<build number>/run_<build id>
Based on the config provided in setup, the only function call you need points gcs-ci
at the directory you wish to uplaod.
js:
const gcsCi = require('gcs-ci');
gcsCi.writeToGcs('path/to/artifacts')
.then(() => console.log('success!'))
.catch((err) => console.error(err));
npm script:
"write-artifacts": "node -e \"require('gcs-ci').writeToGcs('path/to/artifacts')\""
for more information about setup and config, see src/config.js
FAQs
lightweight utility for uploading ci artifacts to gcs
The npm package gcs-ci receives a total of 0 weekly downloads. As such, gcs-ci popularity was classified as not popular.
We found that gcs-ci demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.