Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
hubot-pr-fu
Advanced tools
hubot-pr-fu is a chat bot built on the Hubot framework. It was
initially generated by generator-hubot. The npm
module name is hubot-pr-fu
.
Install the script via npm
:
npm install hubot-pr-fu --save
Add the script to your external-scripts.json
file:
[ "hubot-pr-fu" ]
And start your bot
You can test your hubot by running the following, however some plugins will not behave as expected unless the environment variables they rely upon have been set.
You can start hubot-pr-fu locally by running:
% bin/hubot -a slack
mergeable
key in the response that has
three possible states: true
, false
and nil
. nil
state means
that the mergeability of that PR has not yet been determined, and a
background job has been scheduled. For reasons of making the logic
simpler, we don't display information about these nil
state PRs. So
there might be a rare case where the total number of PRs in pr all
command doesn't match with the sum of mergeable PRs and non-mergeable
PRs in the same command's response.Note: This bot is still under active development, and so has really little error checking (existence of organization or repo, valid permissions etc.). User discretion is advised
pr orgname/repo all
This command returns the PR stats for the repo specified under the specified organization. This information would include:
pr orgname/repo conflicts
This command returns all the PRs which have merge conflicts. This has
more detailed information for those compared to pr all
command.
The title, PR number, link to that PR, assignee and the username who
opened this PR is included in the information.
pr orgname/repo <username>
This command returns all the PRs opened by this user. This includes all
open PRs which are mergeable and non-mergeable. The username
is
assumed to be a valid Github username. For now, there is no
authorization or authentication built-in. Another assumption is that a
username in lowercase is same as capitalized or camelcased. That is, for
a username bootstrap
, the users Bootstrap
, bootStrap
are the same.
One caveat is that the robot will treat every string after pr
other than all
and conflicts
as a username. So, don't abuse this.
Adding a way to make this better is in the works.
Some env vars are assumed to exist:
HUBOT_SLACK_TOKEN
An example script is included at scripts/example.coffee
, so check it out to
get started, along with the Scripting Guide.
FAQs
Advanced Github Flow with Hubot
The npm package hubot-pr-fu receives a total of 1 weekly downloads. As such, hubot-pr-fu popularity was classified as not popular.
We found that hubot-pr-fu demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.