
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Check if the process is running in a Continuous Integration (CI) environment
The is-in-ci npm package is a utility that helps determine if the current environment is a Continuous Integration (CI) environment. This can be useful for conditionally running certain scripts or configurations only when in a CI environment.
Check if in CI environment
This feature allows you to check if the current environment is a CI environment. The module exports a boolean value that is true if the script is running in a CI environment and false otherwise.
const isInCI = require('is-in-ci');
console.log(isInCI); // true if in CI, false otherwise
Check specific CI services
This feature allows you to check if the script is running on specific CI services like Travis CI or CircleCI. The module provides boolean properties for various CI services.
const isInCI = require('is-in-ci');
console.log(isInCI.TRAVIS); // true if running on Travis CI
console.log(isInCI.CIRCLE); // true if running on CircleCI
The ci-info package provides information about the current Continuous Integration environment. It offers more detailed information compared to is-in-ci, including the name of the CI service and whether the environment is a PR build.
Check if the process is running in a Continuous Integration (CI) environment
npm install is-in-ci
import isInCi from 'is-in-ci';
if (isInCi) {
console.log('Running in a CI environment');
}
It looks for these environment variables: CI
, CONTINUOUS_INTEGRATION
, or any with a CI_
prefix.
is-in-ci && echo 'Running in a CI environment'
Exits with code 0
in CI environments and 1
otherwise.
Request the CI service to include the CI
environment variable. Most already do.
is-ci
?The is-ci
package attempts to detect every CI service, which is unsustainable. It also has a higher risk of false-positives. For example, it detects the environment variable RUN_ID
as CI-specific, although other services could use it. Constant updates for new CIs create version fragmentation, resulting in inconsistent behavior across dependent packages. Pushing for CI services to use a standardized CI environment variable is a more robust solution.
FAQs
Check if the process is running in a Continuous Integration (CI) environment
The npm package is-in-ci receives a total of 1,076,701 weekly downloads. As such, is-in-ci popularity was classified as popular.
We found that is-in-ci demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.