Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
hubot-scripts
Advanced tools
These are a collection of community scripts for hubot, a chat bot for your company.
Important: this repository is no longer accepting new scripts. Please read CONTRIBUTING.md for details.
There is a new system for distributing scripts, and adding them to your own hubot. Locate the appropriate script in the hubot-scripts organization or on npm tagged as hubot-scripts, and follow the script's documentation. In general, this will be something like:
Check out the hubot-script-catalog for a list and description of all the available scripts.
Once you have Hubot installed, you should already have hubot-scripts
installed. Check package.json
to be sure. If that is the case, you update
hubot-scripts.json
to list any scripts from this repository you want to load.
The default hubot-scripts.json
looks like:
["redis-brain.coffee", "shipit.coffee"]
If you update hubot-scripts
in package.json
, you will automatically get
updates to your scripts listed here.
Alternatively, you can copy files from this repository into your scripts
directory. Note that you would not get updates from the hubot-scripts
repository unless you copy them yourself.
Any third-party dependencies for scripts need the addition of your
package.json
otherwise a lot of errors will be thrown during the start up of
your hubot. You can find a list of dependencies for a script in the
documentation header at the top of the script.
Restart your robot, and you're good to go.
All the scripts in this repository are located in src/scripts
.
Want to write your own Hubot script? The best way is to take a look at an existing script and see how things are set up. Hubot scripts are written in CoffeeScript, a higher-level implementation of JavaScript.
Additionally, it's extremely helpful to add TomDoc to the top of each
file. (Check out an example). We'll pull out the commands
from those lines and display them in the generic, robot-wide hubot help
command.
Please note we're no longer including external dependencies in the
package.json
, so should you wish to include them please include the package
name and required version in the TomDoc comments at the top of your script.
We're now requiring all scripts in hubot-scripts to contain a documentation header so people know everything about the script.
# Description
# <description of the scripts functionality>
#
# Dependencies:
# "<module name>": "<module version>"
#
# Configuration:
# LIST_OF_ENV_VARS_TO_SET
#
# Commands:
# hubot <trigger> - <what the respond trigger does>
# <trigger> - <what the hear trigger does>
#
# Notes:
# <optional notes required for the script>
#
# Author:
# <github username of the original script author>
If you have nothing to fill in for a section you should include None
in that
section. Empty sections which are optional should be left blank. A script will
be required to fill out the documentation before being merged into the
repository.
FAQs
Allows you to opt in to a variety of scripts
The npm package hubot-scripts receives a total of 24,258 weekly downloads. As such, hubot-scripts popularity was classified as popular.
We found that hubot-scripts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.