
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Grev (gee-rev, short for git review) is a command line utility that streamlines the process of submitting a code review at Recovery Brands. It integrates with JIRA, GitHub, and Slack to transition JIRA task statuses, open a GitHub PR, and notify peer code-reviewers in Slack. Additionally, it contains conveinence features like automatically inserting the JIRA task link in the GitHub PR body and inserting the GitHub PR link in the JIRA task's comment section. Grev works by utilizing each of the previously mentioned services' APIs with the help of InquirerJS for collecting input from the user.
As of right now, grev is only designed to work for Recovery Brands. You can fork this repo and edit config.js to make it work for your own company. You will also need to make sure your JIRA transition IDs are configured accordingly.
grev uses Inquirer.js to prompt the user for input and perform the following actions:
grev continues. If no, grev exits.grev will continue once code editor is closed.frontend-prs Slack channel and tags the users specified in the previous step.Before you can run the tool, you'll need to make sure you have the following entries added to your global .gitconfig file (should be located @ /Users/USERNAME/.gitconfig):
[github]
key = YOUR_GITHUB_API_KEY
self = YOUR_GITHUB_USERNAME
[jira]
key = YOUR_JIRA_API_KEY
self = YOUR_JIRA_USERNAME
url = RECOVERY_BRANDS_JIRA_URL
[slack]
key = YOUR_SLACK_API_KEY
[core]
editor = code --wait
Grev should be installed as a global npm package:
npm install -g grev
or
yarn global add grev
Make sure your terminal is in one of our site's working directory:
.../wp-content/themes/superThemev3/
Make sure your branch name is the JIRA task you are working on:
FE-192
After you've committed and pushed your last changes to GitHub, run the following command:
grev
FAQs
This tool exists to simplify the review process at RB.
We found that grev demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.