
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
A module dependency version policing tool. It goes through all your repositories on github which has package.json. Then it analyzes the dependencies and reports back to you about all the outdated packages.
It also can suggest corrections to your package.json file in certain cases.

Install police globally from npm registry by typing the following command
npm install police -g
For the first time after you installed police, you need to authenticate yourself to github. This is a one-time step
police auth
Note: We will not save your github password anywhere. A token which we acquire during
the authentication will be used thereafter. And it will be saved in a file with permissions 0600
Does not work when 2 factor authorization is enabled. Please create a personal use token here and edit the ./policeconf file.
# To police your module dependencies
police
# To police a particular module (You should give the repository name)
police octonode
# To police another user/org module dependencies
police -u flatiron
# To police a particular module of another user/org (You should give the repository name)
police flatiron/plates
# To police a local module or package.json file
police -l ~/octonode
police -l ~/octonode/package.json
# To continue checking even though errors are encountered (Doesnt work with -l)
police -f
police -u flatiron -f
# To edit all the fields in package.json (Doesnt work with -l)
police -e
# To add the missing fields to package.json (Doesnt work with -l)
police -a
# To update dependencies in package.json
police -t
Given below are some ideal commands to help you.
# An ideal police command for github user for the first time on a module
police -f -e -t
# An ideal police command for github user
police -f -a -t
# An ideal police command locally
police -l ~/octonode -t
The token which we acquied during auth will be stored in $HOME/.policeconf. If you want to use another config file
police octonode --conf /etc/policeconf
police octonode --conf ~/.conf
If you want to destory your token, you can use
police -d
police --destroy
Calling police with help option will display all the above
police -h
police --help

If you like this project, please watch this and follow me.
npm test
Here is a list of Contributors
I accept pull requests and guarantee a reply back within a day
MIT/X11
Report here. Guaranteed reply within a day.
Pavan Kumar Sunkara (pavan.sss1991@gmail.com)
Concept by: Martin Wawrusch (martin@wawrusch.com)
FAQs
policing tool for dependency package versions
We found that police demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.