
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
github-deploy
Advanced tools
github-deploy is a simple, yet powerful command-line utility for creating deployments on GitHub.
-e flag to specify an alternative deployment environment.package.json in the deployment payload.-V, -VV, or -VVV flags.GITHUB_TOKEN environment variable.Before using github-deploy, ensure that you have:
GITHUB_TOKEN with the required permissions set as an environment variable for authentication.Install github-deploy globally using npm to use it from anywhere on your system:
npm install -g github-deploy
Alternatively, you can use it directly without installing by using npx:
npx github-deploy
By default, this will deploy to the production environment:
github-deploy
To deploy to a different environment, use the -e or --environment flag:
github-deploy -e staging
Add arbitrary data to the deployment payload using the -p or --payload flag with a JSON string:
github-deploy --payload '{"deployer":"john","buildNumber":123}'
The custom payload will be merged with the version from package.json. For example, if your version is 1.0.0 and you pass the above payload, the final payload will be:
{
"version": "1.0.0",
"deployer": "john",
"buildNumber": 123
}
Preview what would be sent to the GitHub API without actually making the request:
github-deploy --dry-run
This is useful for testing and debugging your deployment configuration.
Control the amount of output detail using the -V flag. You can stack it for more verbosity:
github-deploy
# ✅ Deployment created: 123456789
# URL: https://api.github.com/repos/owner/repo/deployments/123456789
-V: Basic deployment informationgithub-deploy -V
# Shows: ID, URL, State, Created at
-VV: Detailed JSON outputgithub-deploy -VV
# Shows formatted JSON with deployment details
-VVV: Full API responsegithub-deploy -VVV
# Shows complete response from GitHub API
You can combine multiple options:
github-deploy -e staging --dry-run -VV --payload '{"region":"us-east-1"}'
For github-deploy to authenticate with GitHub, you must provide a GITHUB_TOKEN environment variable. Follow these steps to set it up:
export GITHUB_TOKEN="your_token_here"
Contributions to github-deploy are welcome! Whether it's reporting a bug, discussing improvements, or submitting a pull request, all contributions are appreciated.
FAQs
A tool for creating github deployments
We found that github-deploy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.