Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Simple deployment tool for monorepo
This is run at the root of the repository to initialize kuda. You will be asked to select a service (folder) you wish to have managed under kuda.
kuda init
Once a repository is initialized, a kuda.json
will be generated in the root of the repository.
You can continue adding services using the add command or alternatively, update kuda.json
or package.json
to reflect the changes you want.
kuda add
This command will attempt to run all the tasks for each service defined in kuda.json
. Once all tasks have completed successfully, the remoteState
is updated.
The localVersion
(derived from package.json
) and the remoteVersion
are compared before deployment. If the remoteVersion
is up to date, no action will be taken.
Thus, in order to trigger tasks to run, the user is required to increment the version
inside <service>/package.json
KUDA_ENV=staging kuda run
You can now target a specific service using
KUDA_ENV=staging kuda run -s foo
monorepo
├── foo
│ └── package.json
├── bar
│ └── package.json
├── unmanagedFolder1
├── unmanagedFolder2
├── kuda.json
services: [
{
name: 'foo'
},
{
name: 'bar'
}
],
remoteState: s3://monorepo/{KUDA_ENV}/kudastate
This will run task(s) for foo and then task(s) for bar.
name: 'foo'
version: 0.0.1,
kuda: {
tasks: [
{
name: 'foo',
command: 'echo {SOME_ENV}'
},
{
name: 'bar',
command: 'cat file.json stuff.json'
}
]
}
services: {
foo: {
deployedVersion: '0.0.0'
},
bar: {
deployedVersion: null
}
}
child process maxBuffer issue. might need to stream-- Increased buffer to fix
Add some tests...
currently change detection is based on package.json,
can swap out for other means like using git commits (compare with s3 stored remote), git tags, timestamps
(ie <SERVICE_NAME> <SERVICE_VERSION>)
allow users to control deployment flow by creating dependency tree
allow different types of task (or not) (ie. tasks that are run regardless of whether there has been change)
FAQs
Simple deployment tool for monorepo
The npm package kuda receives a total of 2 weekly downloads. As such, kuda popularity was classified as not popular.
We found that kuda demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.