
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
hubot-github-adapter
Advanced tools
Hipchat adapter for Github. Talk to your Hubot from issue and pull request comments.
A Hubot adapter to use with Github.
Use this adapter to have Hubot listen and comment on Github issues and pull requests.
We use pull requests a lot. Now that we have a Hubot listening to our Pull Request chatter, we can do things like:
So, basically all the cool stuff that Hubot already does, but in the context of Github comments.
Follow the Hubot instructions to create a new bot.
####Install this adapter:
cd /path/to/hubotyo hubotnpm install hubot-github-adapter --save####Create a Github User for your bot:
This is the user your Hubot will use to post comments.
(Keep this token as secret as you would a password.)
####Create a Github Webhook for your each of your repositories: You'll need to create a Github webhook for every repository you want Hubot to listen to.
Create a new webhook for your myuser/myrepo repository at:
https://github.com/myuser/myrepo/settings/hooks/new
Set the webhook url to: <HUBOT_URL>:<PORT>/hubot/github-repo-listener
For example, if your hubot lives at myhubot.herokuapp.com, then you will set the webhook URL to: http://myhubot.herokuapp.com/hubot/github-repo-listener
All of your repositories will point to the same URL.
####Configure your Hubot
Set the HUBOT_GITHUB_TOKEN environment variable to the token you created above.
Let's say you gave your Hubot user the name "BestHubotEver" You'll want to start your hubot with that name:
HUBOT_GITHUB_TOKEN=some-long-guid-number ./bin/hubot --adapter github-adapter --name BestHubotEver####Test Your Hubot
Hubot is now listening to your comments on issues and pull requests.
You should be able to say:
@BestHubotEver ping, and if he is listening, he will respond with PONG
If you want to test your bot locally, you can create a temporary webhook that goes to your machine instead of a live Hubot. See detailed instructions on the hubot-github-webhook-listener page.
This adapter uses the following environment variables:
HUBOT_GITHUB_TOKEN - This is the auth token for the Github user you created above.It's customary to name adapters simply hubot-<adapter>, however github-hubot is taken.
Copyright © YouNeedABudget.com, LLC. (Github: YNAB)
Taylor Brown, aka Taytay
MIT License; see LICENSE for further details.
FAQs
Hipchat adapter for Github. Talk to your Hubot from issue and pull request comments.
We found that hubot-github-adapter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.