
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
grep-components
Advanced tools
Komponentbibliotek for Grep. Brukes i Læreplanutvikleren og Grepadmin.
npm i grep-components
cjs
and es
module formatsPushing to master
or any feature-branch (feature/some-feature
) will automatically run the release-workflow. This will build the package, analyze the commits to determine next version number and publish the new version to NPM and Github. Current and previous runs can be seen here.
Semantic-release will determine the next version number by looking at the commit message prefix:
Prefix | Release type | Example commit message |
---|---|---|
'BREAKING CHANGE: ' in commit message footer | Major release | revert: Reverting some changes BREAKING CHANGE: this revert will break something |
feat | Minor release | feat: Some minor changes |
fix, perf, revert, refactor, build/chore(deps*) | Patch release | fix: Some fixes |
If a commit contains none of these, then no release will be created / published.
The release-workflow can also be manually triggered from here, but will still only release if there is a commit with a valid prefix.
feature/
to be included in the release-workflow. Example: feature/some-feature
feature/
part, as a dist-tag in NPM. Example: feature/some-feature
on version 0.18.0 will become 0.18.0-some-feature.1
and can be installed by running npm i grep-components@some-feature
FAQs
Grep komponentbibliotek
We found that grep-components demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.