
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
htaccess-punk
Advanced tools
.htaccess Punk checks the redirect targets defined in .htaccess files. It follows redirect chains to verify where they ultimately resolve and what HTTP status they return, thus helping to fight redirect rot.
npx htaccess-punk [options] [directory]
directory defaults to the current working directory. .htaccess Punk scans it recursively.
| Option | Short | Description |
|---|---|---|
--errors | -e | Show only error results (HTTP 4xx+ and connection failures); summary still reflects all checked URLs |
--help | -h | Show usage information |
import { check } from 'htaccess-punk';
const { files, urls, urlToFiles, results } = await check('/path/to/dir');
urlToFiles is a Map<string, string[]> of each target URL to the .htaccess files that reference it. results is an array of objects:
{
url, // original target URL
status, // final HTTP status code
finalUrl, // final URL after following redirects (null if no redirects)
chain, // array of `{ url, status }` for each hop
error, // error message if the request failed (`status` and `finalUrl` absent)
}
check() also accepts an options object:
await check(dir, {
concurrency: 5, // parallel requests (default: 5)
onReady({ files, urls }) {}, // called after files are found and targets extracted
onResult(result) {}, // called for each result as it comes in
});
.htaccess Punk:
.htaccess files in the given directory, recursively (skipping node_modules and .git)Redirect, RedirectPermanent, RedirectTemp, RedirectMatch, and RewriteRule directives to extract absolute target URLs$1, %1, etc.)—these depend on the matched request path and can’t be checked without itThe check() function returns raw result data. The CLI (bin/htaccess-punk.js) collects those results and prints them grouped by .htaccess file, with the final status color-coded: green for 2xx, yellow for 3xx (further redirect from the final hop, e.g. a loop or exceeded redirect limit), red for 4xx/5xx. When a target redirected before settling, the final URL is shown below it.
FAQs
Redirect checker for .htaccess files
The npm package htaccess-punk receives a total of 0 weekly downloads. As such, htaccess-punk popularity was classified as not popular.
We found that htaccess-punk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.