Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
github2range
Advanced tools
Range helps teams know what’s happening, stay in sync, and actually feel like a team. It’s thoughtfully designed software that helps teams share daily check-ins, track goals, and run better meetings. So you can do your best work together.
Everything is easier in Range because it works with the tools you already use. Your tasks, documents, and code changes are already in Range, so you don’t have to enter data twice.
Find out more at www.range.co.
Range supports native integrations for both GitHub and GitHub Enterprise via GitHub's OAuth APIs. However in some situations it is not possible to use these APIs, either due to administrative controls or firewalls that prevent API access.
This package provides a self-hosted script that allows you to generate GitHub suggestions without giving Range direct access to GitHub APIs or tokens.
npm install -g github2range
Example:
$ github2range --config our-team.json
▸ Collecting events for dpup after 7/16/2019, 6:51:51 PM
• range-labs : 45 events in period
• Suggestion for dpup CODE_CHANGE MERGED : admin: fixes updating of name
• Suggestion for seanami CODE_CHANGE MERGED : Fix issues with getUserListForOrg
• Suggestion for dpup CODE_CHANGE MERGED : materializer: create views for org stats
▸ Saw 2 events from unmapped users: kowitz, stephyeung
▸ 3 suggestions found, sending to Range
▸ All done!
githubAccessToken - A personal API key for GitHub with repo and user scopes.
githubHost - The API hostname for your GitHub Enterprise instance. Default: api.github.com
rangeWebhook - The URL for the Range webhook where suggestions will be posted.
users - A map of GitHub usernames to the email address of a Range user.
maxAge - The maximum age of events that should be processed. Default: 24.
See sample-config.json
for a template of a minimal configuration file. See below for additional
options.
This config can be passed as a flag, --config config.json
, or saved in one of the following
locations:
~/.github2rangerc
~/.github2range/config
~/.config/github2range
~/.config/github2range/config
/etc/github2rangerc
/etc/github2range/config
This repository provides a Dockerfile
which can be used to execute github2range
. You can
customize the Dockerfile and copy over a config file to one of the above locations, or you can pass
configuration options to docker via environment variables. For example:
docker build -t github2range .
docker run \
--env github2range_githubAccessToken=XXXXXXXX \
--env github2range_rangeWebhook=https://in.range.co/services/incoming/XXXXXXXX \
--env github2range_users__catboy=conner@pjmasks.com \
--env github2range_users__owlette=amaya@pjmasks.com \
--env github2range_users__ghlogin=email@company.com \
github2range
A prebuilt is available on Docker hub at pupius/github2range.
To get a GitHub access token, visit https://github.com/settings/tokens (or the equivalent page on
your GitHub Enterprise instance.) and follow the steps to create a new token. Specify the repo
and
user
scopes.
Find the "Custom Integrations" section at the bottom of https://range.co/_/settings/integrations. Note that some workspaces require that you be an admin to create webhools. This webhook can be used to create suggestions for anyone in your org. See this help center article for more information about the incoming webhooks.
FAQs
Self-hosted GitHub integration for Range.
We found that github2range demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.