
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
git-pull-run
Advanced tools
Automatically run commands like npm install when fetching changes from git, but only if certain files have changed.
Git invokes the post-merge
hook after a git pull
was done a local repository. This package will then run git diff-tree
to get a list of changed files. Each changed file is being matched against the specified pattern and in case of a match, the specified command or script will be executed.
For more information, please refer to my post: Automatically Install NPM Dependencies on Git Pull
npm install --save-dev git-pull-run
This package should be executed as a post-merge
git hook.
> npx git-pull-run --help
Usage: git-pull-run [options]
Options:
-V --version output the version number
-p, --pattern <glob> pattern to match files (required)
-c, --command <command> execute shell command for each matched file
-s, --script <script> execute npm script for each matched file
-m, --message <message> print message to the console if matches were found
-d, --debug print additional debug information (default: false)
-h, --help display help for command
--pattern <pattern>
: Required glob pattern to detect if certain files have changed on the remote repository when pulling changes. Each changed file (including path from root) is matched against this pattern.
--command <command>
: Command to execute on the shell for each changed file that matches the pattern
. The command is going to be executed inside the directory of the changed file.
cwd
option set as directory of the matched file.--script <script>
: NPM script to execute on the shell for each changed file that matches the pattern
. Same as option --command "npm run <script>"
. The script is going to be executed inside the directory of the changed file.--message <message>
: Message to print on the shell if any changed files matches the pattern
. The message is printed only once and not for each changed file.--debug
: Run in debug mode and print additional information about the changed files and commands and scripts that are being executed.npm install
when package-lock.json
changespost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# matches only the package-lock.json inside project directory
npx git-pull-run --pattern "package-lock.json" --command "npm install"
On Windows, white spaces in the command like npm install
must be escaped with backslashes, for example: npx git-pull-run --pattern "package-lock.json" --command "npm\ install"
npm install
in a multi-package monorepopost-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# assumes monorepo structure with multiple packages in directory /packages
# matches any of these package-lock.json
npx git-pull-run --pattern "packages/*/package-lock.json" --command "npm install"
post-merge
git hook with Husky:
#!/bin/sh
. "$(dirname "$0")/_/husky.sh"
# matches only the package-lock.json inside project directory
npx git-pull-run --pattern "package-lock.json" --message "Some packages were changed. You may run npm install to update your dependencies..."
package.json
or package-lock.json
?The package.json
contains the semver versions of each package whereas the package-lock.json
contains the exactly installed version of each package. See But what the hell is package-lock.json? for more information.
npm install
or npm ci
?Discussion on: But what the hell is package-lock.json?:
npm install
does not ignorepackage.json
versions, nor does it ignore thepackage-lock.json
. What it does is verify that thepackage.json
andpackage-lock.json
correspond to each other. That is, if the semver versions described inpackage.json
fit with the locked versions inpackage-lock.json
,npm install
will use the latter completely, just likenpm ci
would.Now, if you change
package.json
such that the versions inpackage-lock.json
are no longer valid, yournpm install
will be treated as if you'd donenpm install some-pkg@x.y.z
, where x.y.z is the new version in thepackage.json
for some-package.
On Windows, white spaces in the command like npm install
must be escaped with backslashes, for example: npx git-pull-run --pattern "package-lock.json" --command "npm\ install"
Issue: Command failed with exit code 1: npm #1
The yarn.lock
file should be used as pattern option (instead of package-lock.json
) and the yarn install
should be used as command option (instead of npm install
). If you want to run scripts defined in the package.json
with yarn instead of npm, please use the command option with --command "yarn run <script>"
instead of --script "<script>"
.
FAQs
Run commands and scripts after git pull
We found that git-pull-run demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.