
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
gh-release-assets
Advanced tools
Upload assets to a GitHub release. Based on the awesome work of @remixz as part of publish-release.
npm install gh-release-assets
Pass in the upload url and an array of local files you'd like to upload. If you want to specify a new name for the file once it is uploaded, use an object with a name
and path
keys.
var ghReleaseAssets = require('gh-release-assets')
ghReleaseAssets({
url: 'https://uploads.github.com/repos/octocat/Hello-World/releases/1197692/assets{?name}',
token: [MY_GITHUB_TOKEN],
assets: [
'/path/to/foo.txt',
'/path/to/bar.zip',
{
name: 'baz.txt',
path: '/path/to/baz.txt'
}
]
}, function (err, assets) {
console.log(assets)
})
GitHub returns the upload url in the correct format after you create a release as upload_url
. You can also get the upload url from the releases
endpoint like:
curl -i https://api.github.com/repos/:owner/:repo/releases
You can also use a username/password instead of a token by passing an auth
object:
var ghReleaseAssets = require('gh-release-assets')
ghReleaseAssets({
url: 'https://uploads.github.com/repos/octocat/Hello-World/releases/1197692/assets{?name}',
auth: {
username: 'CoolGuy'
password: 'KeepItSecret'
},
assets: [
'/path/to/foo.txt',
'/path/to/bar.zip',
{
name: 'baz.txt',
path: '/path/to/baz.txt'
}
]
}, function (err, assets) {
console.log(assets)
})
Either a token
or auth
is required.
gh-release-assets
also emits the following events:
upload-asset
- {name}
- Emits before an asset file starts uploading. Emits the name
of the file.upload-progress
- {name, progress}
- Emits while a file is uploading. Emits the name
of the file, and a progress
object from progress-stream
.uploaded-asset
- {name}
- Emits after an asset file is successfully uploaded. Emits the name
of the file.Contributions welcome! Please read the contributing guidelines before opening an issue or making a pull request.
engines
field of package.json
(https://github.com/ungoldman/gh-release-assets/pull/17)FAQs
Upload assets to a GitHub release
We found that gh-release-assets demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.