Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
gfw-components
Advanced tools
Showcase of GFW components with the use of react Styleguidist library.
yarn && yarn start
This will set up the app running on port 6060.
Merging PRs to master or pushing commits directly into master triggers Travis CI that checks if the commit is tagged and if it is, it automatically publishes a new version to NPM. To have a full control over the releases, we're tagging the commits locally. To tag a commit and trigger npm publish upon pushing to master, follow these steps:
npm version patch|minor|major -m "Bumping to %s"
git push
to push the commit with bumped version to mastergit push --tags
to push the tagsFAQs
React component library for the Global Forest Watch project.
The npm package gfw-components receives a total of 20 weekly downloads. As such, gfw-components popularity was classified as not popular.
We found that gfw-components demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.