
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
pull-request-vir
Advanced tools
GitHub Action for pull requests.
type docs: https://electrovir.github.io/pull-request-vir
Install this package into whatever repo you're planning to use it.
npm i -D pull-request-virCreate a config file somewhere in the repo (not within source code).
The config file can be named anything but must be JavaScript or TypeScript.
If using TypeScript, import the Config type into the config file.
Create a config object that matches that type and export it as the default output:
import {type Config} from 'pull-request-vir';
export const config: Config = {
// see type definition for full config options
assignToAuthor: true,
blockNoMerge: true,
reviewRules: [
{
autoAdd: true,
users: [
'electrovir',
'another-user',
'ghost',
],
required: 2,
codeOwners: {
paths: [/^src\/backend\//],
},
},
],
};
Define a GitHub Actions workflow that uses pull-request-vir:
# recommended triggers
on:
pull_request_review:
types: [submitted, dismissed]
pull_request:
types:
[
opened,
reopened,
labeled,
edited,
ready_for_review,
review_requested,
review_request_removed,
]
jobs:
merge-checks:
runs-on: ubuntu-latest
steps:
# pull-request-vir needs the repo checked out so it can read your config
- uses: actions/checkout@v4.1.1
- uses: electrovir/pull-request-vir@latest
with:
config_file: relative/path/to/config.ts
Push to GitHub and watch the magic.
FAQs
GitHub Action for pull requests
The npm package pull-request-vir receives a total of 482 weekly downloads. As such, pull-request-vir popularity was classified as not popular.
We found that pull-request-vir demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.