
Security News
Feross on TBPN: How North Korea Hijacked Axios
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.
A pattern-based ignore generator.
Lala is a command line program for generating common, pattern-based ignore files. Lala leverages the well-built templates provided in the github/gitignore repository using the the GitHub API. Lala was inspired by karan/joe.
Lala is meant to be installed as a global npm module, making the program lala available everywhere in your terminal:
$ npm install -g lala
For command line help:
$ lala help
To get a list of available ignore templates:
# Lists available ignore templates
$ lala list
Lala can output both individual and combinations of ignore templates. Lala outputs them as console messages which can be piped into another file for use.
Command line pattern:
lala ignore <template...>
As a real-world example, let's build an ignore file for a Git repository containing a Visual Studio solution with ASP.NET/C# projects that leverage node/npm tooling:
# Create a file containing the ignore pattern templates for a Git repository
$ lala ignore visualstudio node > .gitignore
# Or create the file by individually appending each ignore pattern template
$ lala ignore visualstudio >> .gitignore
$ lala ignore node >> .gitignore
# Or use a Mercurial repository instead
$ lala visualstudio node > .hgignore
Lala uses the GitHub API to pull down the latest templates from the github/gitignore repository. The GitHub API allows up to 60 requests per hour, unauthenticated, for a given IP address. In all but the most extreme usage scenarios you would have a difficult time exceeding that rate limit with Lala alone.
To see your rate limit for the current configuration of Lala:
# Check your rate limit
$ lala limit
In the event that you need to increase your rate limit beyond what is provided anonymously, you can set your GitHub username and password or API token:
# Run the configuration wizard
$ lala config
# Or bypass the configuration wizard and send the values by command line parameters
$ lala config -u <GitHub_username> -p <GitHub_password_or_token>
FAQs
A pattern-based ignore generator.
We found that lala demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.

Security News
OpenSSF has issued a high-severity advisory warning open source developers of an active Slack-based campaign using impersonation to deliver malware.

Research
/Security News
Malicious packages published to npm, PyPI, Go Modules, crates.io, and Packagist impersonate developer tooling to fetch staged malware, steal credentials and wallets, and enable remote access.