
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Set up NPM project in docker environment:
$ docker run --rm -v $PWD:/code -it node /bin/bash
# cd /code
Create new app:
# echo 'console.log("Hello world");' > index.js
# npm init -y
# npm -s start
Hello world
# npm -s test
All good
Install program and plugins:
# npm install -g semantic-release @semantic-release/gitlab
Set gitlab and npm registry configurations:
# export GL_TOKEN=<token>
# export GL_URL=https://gitlab.com
# export NPM_TOKEN=<token>
Run in dry-run mode:
# semantic-release -p @semantic-release/commit-analyzer,@semantic-release/release-notes-generator,@semantic-release/gitlab,@semantic-release/npm -b master -d
⚠ Run automated release from branch master in dry-run mode
✔ Allowed to push to the Git repository
ℹ Verify GitLab authentication (https://gitlab.com/api/v4)
ℹ Verify authentication for registry https://registry.npmjs.org/
ℹ Found 2 commits since last release
ℹ Analyzing commit: chore(ci): added gitlab CI config file
ℹ The commit should not trigger a release
ℹ Analyzing commit: feat(core): initialized app
ℹ The release type for the commit is minor
ℹ Analysis of 2 commits complete: minor release
ℹ There is no previous release, the next release version is 1.0.0
⚠ Skip v1.0.0 tag creation in dry-run mode
⚠ Skip step "publish" of plugin "@semantic-release/gitlab" in dry-run mode
✔ Published release 1.0.0
ℹ Release note for version 1.0.0:
# 1.0.0 (2018-12-23)
### Features
* core: initialized app (09a00be (https://gitlab.com/plup/siblab-nodejs/commit/09a00be))
Sample of .gitlab-ci.yml file:
---
image: node
stages:
- test
- release
before_script:
- npm -s install
cache:
paths:
- node_modules/
test:
stage: test
script:
- npm test
publish:
stage: release
before_script:
- npm install -g semantic-release @semantic-release/gitlab
script:
- semantic-release -p @semantic-release/commit-analyzer,@semantic-release/release-notes-generator,@semantic-release/gitlab,@semantic-release/npm -b master
only:
- master
Make some commits:
$ git commit --allow-empty -m "fix(cd): triggers patch"
$ push
$ git commit --allow-empty -m "feat(release): triggers minor"
$ push
$ git commit --allow-empty -m "chore(doc): triggers nothing"
$ push
$ git commit --allow-empty -m 'chore(doc): triggers major
BREAKING CHANGE: Heads up !'
$ push
Check results:
$ git tag --list
v0.1.0
v0.1.1
v0.2.0
v1.0.0
3.0.1
FAQs
Test application
The npm package plup-hello receives a total of 0 weekly downloads. As such, plup-hello popularity was classified as not popular.
We found that plup-hello demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.