Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Morto is a set of tools to help with managing a monorepo.
It currently does these things:
morto setup
.morto test <filename>
.morto distribute
.Morto organises projects by subdirectory. It currently assumes that each subdirectory is its own project, and that there are no dependencies between projects.
You can put system integration tests in subdirectories too, but those are not projects. If a system integration test changes, Morto will run all the tests.
Morto assumes you have a .morto.js
in the root of your repo. Ours looks something like this:
module.exports = {
projects: {
topLevelSetup: {
alwaysRun: true,
setupCommands: {
common: [
'(which ruby && which gem) || echo "Please make sure ruby/gem are installed"',
'(which node && which yarn) || echo "Please make sure node/yarn are installed"',
],
osx: [
'which brew || echo "Please make sure brew (Homebrew) is installed"',
'gem install bundler',
'bundle install',
'overcommit --install',
'overcommit --sign',
],
ci: [
'sudo apt-get update',
'bundle check --path=~/.bundle || bundle install --deployment --path=~/.bundle',
],
},
distributeCommands: {
common: [],
},
},
linters: {
alwaysRun: true,
testRunners: [
'bundle exec overcommit --sign',
'SKIP=AuthorEmail,AuthorName,ForbiddenBranches bundle exec overcommit -r',
],
},
core: {
subDirectory: 'core',
setupCommands: {
common: [
'(which psql && which createdb) || echo "Please make sure PostgreSQL is installed"',
'which redis-cli || echo "Please make sure Redis is installed (but not running)"',
'test -e .env || cp .env.sample .env',
'yarn install --pure-lockfile',
],
osx: [
'bundle install ',
'bundle exec rake db:reset --trace',
],
ci: [
'bundle check --path=~/.bundle || bundle install --deployment --path=~/.bundle',
'yarn run build',
'RAILS_ENV="test" RACK_ENV="test" bundle exec rake db:create db:structure:load --trace',
],
},
distributeCommands: {
ci: [
'git push -f git@heroku.com:staging-remix-core.git $CIRCLE_SHA1:refs/heads/master',
'heroku run --exit-code rake db:migrate --app staging-remix-core',
'heroku restart --app staging-remix-core',
'heroku config:set RELEASE_NUMBER=$((`heroku config:get RELEASE_NUMBER -a staging-remix-core` + 1)) -a staging-remix-core',
],
},
fileTestRunner: 'bundle exec rspec --format progress --format RspecJunitFormatter --out junit.xml',
junitOutput: 'junit.xml',
},
keystone: {
subDirectory: 'keystone',
setupCommands: {
common: [
'test -e .env || cp .env.sample .env',
'virtualenv venv',
'venv/bin/pip install --upgrade pip',
],
osx: [
'venv/bin/pip install --upgrade -r requirements.txt',
],
ci: [
'venv/bin/pip install --upgrade -r requirements.txt -q --log $CIRCLE_ARTIFACTS/pip-keystone.log',
],
},
distributeCommands: {
common: [
'make deploy-stage',
],
},
testRunners: [
'make coverage && venv/bin/codecov',
],
},
},
};
We should add more documentation at some point, but at least this should give you a rough idea of what is possible.
subDirectory
(in which case it will only setup/test that project in CI if files in that directory have changed) or alwaysRun
.setupCommands
, split between common
(run regardless of platform), osx
(run only when you don't use the --ci
flag) or ci
(run only when you use the --ci
flag).testRunners
(simply runs the commands) or fileTestRunner
(will use this command when passing in a file, e.g. morto test core/file_spec.rb
would run something like cd core && bundle exec rspec file_spec.rb
).junitOutput
, which we will collect in one output if you use the --junitOutput
flag.Morto is currently pretty tied to CircleCI and Github. Our circle.yml
looks something like this:
dependencies:
cache_directories:
- "~/.bundle"
- "~/.yarn-cache"
- "core/node_modules"
override:
- yarn config set cache-folder ~/.yarn-cache
- yarn install --pure-lockfile
- node_modules/.bin/morto setup --ci
database:
override: []
test:
override:
# Service-specific tests (only for what has changed), using CircleCI's test balancing:
- node_modules/.bin/morto test --runTestRunners --junitOutput $CIRCLE_TEST_REPORTS/reports/junit.xml:
parallel: true
files:
- core/spec/**/*_spec.rb
deployment:
staging:
branch: master
commands:
- yarn run morto -- distribute --ci
osx
and ci
.FAQs
MOnoRepoTOols
We found that morto demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.