Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
This is a cli tool to sync local git repository and remote GitHub repository automatically.
For example, if your tech team and biz team share some codebase, tech team wants to manage it with git (and GitHub) but biz team wants to edit files directly via FTP, right?
You can resolve this problem with ghsync.
git add
, git commit
and git push
.git pull
.Additionally, if some auto-push and auto-pull conflict, ghsync stops observing soon and sends you a notification email. So you don't have to worry about that ghsync destroys your codebase.
This tool requires local git version 1.7.9.6 or later for using --no-edit
option for git pull
.
$ npm install -g ghsync
At first run ghsync init
to generate configuration file in ~/.config/ghsync/default.yml
with initial content and tailor this file.
$ ghsync init
$ vi ~/.config/ghsync/default.yml
git commit
so that prevents creating many commits uselessly)At first, configure webhook on GitHub.
And start ghsync server on your server.
$ ghsync run
That's it.
When local git repository is directly edited ghsync commits it with message "Automatically committed". And When remote GitHub repository is updated ghsync pulls it soon.
If some auto-push and auto-pull conflict, ghsync stops observing soon and sends you a notification email like below.
Subject: [ghsync] Error occurred in auto git-pull
[path]
/path/to/local/repo
[stdout]
Updating 40a9764..dc47ada
[stderr]
From github.com:owner/repo
* branch master -> FETCH_HEAD
40a9764..dc47ada master -> origin/master
error: Your local changes to the following files would be overwritten by merge:
some/changed/file
Please, commit your changes or stash them before you can merge.
Aborting
Then you should go to your server and resolve conflict by hand, and commit and push it.
After you push it, auto-pull runs because remote GitHub repository is updated just now by you, and this pulling will get successful. Then, ghsync starts observing again automatically.
You may want to run ghsync on background. You can use Supervisor or something to do that. But especially for Node.js script it's one of the easiest way to use forever.
# install forever
$ npm install -g forever
# run ghsync via forever
$ forever start $(which ghsync) run
# confirm process is running
$ forever list
info: Forever processes running
data: uid command script forever pid id logfile uptime
data: [0] H7wO /usr/local/bin/node /usr/local/bin/ghsync run 59716 59726 /home/user/.forever/H7wO.log 0:0:0:2.636
You can stop daemon by like below.
$ forever stop 0
Please learn more at forever GitHub repository.
FAQs
Sync local git repository and remote GitHub repository automatically.
We found that ghsync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.