
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A simple tool for commit-based analysis of your codebase.
There are tons upon tons of ways to analyze your code but with this simple tool you can map codebase problems to business problems. For example if there are a lot of fixes in file 'a' this file should be refactored or you should write more tests for this file. It is pretty useful when you are beginning working with a large codebase, considering refactoring or writing tests, this tool may indicate where to start.
The tool is language agnostic, you can run it against js, ts, dart, java, basically against whatever you want.
You need just to pass an extension and that it.
You should get nodejs first.
Then you will be able to install 'hotfiles' globally or you will be able to run the tool with npx
npm i -g hotfiles
hotfiles --repo=path_to_your_cloned_repo
or
npx hotfiles --repo=path_to_your_cloned_repo
--repo, -r - Path to your project (mandatory)
--path, -p - Specific path inside of your project
--limit, -l - Number of commits to analyze (Infinity by default)
--message, -m - Filter for commit message (will be treated as a regex)
--ext, -e - List of file extensions to check
--ignoreExt, -e - List of extensions to ignore
--json, -j - Path to output file
hotfiles --repo='./my-awesome-project' --path='src' --limit=100 --message='fix:' --ext=.js --ext=.rb
This call will scan last 100 commits in my-awesome-project under src path where commit message contains fix: and a report will contain only files with extensions .js and .rb.
hotfiles --repo='./my-awesome-project' --limit=100 --ext=.ts --ext=.tsx --json=./output.json
This call will scan last 100 commits in my-awesome-project, report will contain only files with extensions .ts and .tsx and will be saved as json to ./output.json
FAQs
Start your next refactoring by knowing where to start
The npm package hotfiles receives a total of 1 weekly downloads. As such, hotfiles popularity was classified as not popular.
We found that hotfiles demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.