
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
own-contribution-graph
Advanced tools
own-contribution-graphSay your company doesn't use GitHub, but you still want to continue your contribution graph on your GitHub account.
This tool will scan local repositories, and create a new repository with a series of empty commits that replicate your contributions seen in the local repositories.
Create a configuration file in JSON:
{
"sourceRepositories": {
"paths": [
"<path-to-repo>",
"<path-to-directory-containing-multiple-repos>/*"
],
"possibleBranchNames": ["origin/master", "origin/main"],
"authorEmails": ["<email>"]
},
"contributionsRepository": {
"path": "<repo-path>",
"remote": "origin git@github.com:<username>/<repository>.git",
"includeRepositoryNameInCommits": true
}
}
Notes:
sourceRepositories:
paths contains the paths of the local repositories to scan; a path can be:
/*.possibleBranchNames contains the branch names that will be looked for in the local repositories; once a branch is found, commits will be looked for in it.authorEmails contains a list of email addresses; the tool will retrieve commits made by these emails addresses.contributionsRepository:
path contains the path to the contribution repository; it needs to not exist the first time the tool is run.remote (optional) contains the name and URL of a remote to add to the repo; this will allow you to easily run git push, potentially with --force, afterwardsincludeRepositoryNameInCommits (optional), if true, the name of the repository will be included in commit messages.Run owncontributiongraph and provide it with the path to the config file:
owncontributiongraph --config=<json-config-file-path>
Push this repo to GitHub, or anywhere else.
On subsequent runs, only new commits will be added to the contribution repository.
FAQs
Replicate contributions from external git hosts to GitHub
We found that own-contribution-graph demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.