
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
shipit-yarn
Advanced tools
A set of tasks for Shipit used for yarn specific tasks on deploy.
Heavily inspired by the shipit-npm extension by callerc1. It started as a fork of his repository.
Features:
updated
or fetched
event from shipit-deploynpm install shipit-yarn --save-dev # or yarn add -D shipit-yarn
Run: (This triggers the yarn
task on the deploy updated
or
fetched
event. No additional config necessary.)
shipit staging deploy
Or you can run the tasks separatly :
shipit staging yarn:init yarn:install
shipit staging yarn:run --cmd "update"
shipit.config.yarn
yarn.remote
Type: Boolean
Default: true
A Boolean to determine whether to run the task in local workspace or on the remote.
yarn.installArgs
Type: Array
or String
Default: []
An array or string specifying yarn args passed to the yarn install cmd.
yarn.installFlags
Type: Array
or String
Default: []
An array or string specifying yarn flags passed to the yarn install cmd.
yarn.triggerEvent
Type: String
,Boolean
Default: updated
or fetched
(depending on yarn.remote
value)
An event name that triggers yarn:install
. Can be set to false to prevent the
yarn:install
task from listening to any events.
yarn install cmd.
yarn.yarnOrNpm
Type: String
Default: yarn
Determine which package manager should be used. Can be yarn
, npm
or best
(try with yarn and fallback to npm if
yarn is unavailable).
yarn.cmd
Type: String
Default: ''
(empty string)
A string specifying the command to be run by the
yarn:cmd
task (e.g. 'run build'
) overridden if the --cmd
argument is set on the command line.
shipitfile.js
options usagemodule.exports = function (shipit) {
require('shipit-deploy')(shipit);
require('shipit-yarn')(shipit);
shipit.initConfig({
default: {
yarn: {
remote: true,
installFlags: ['--production']
}
}
});
};
yarn.installArgs
or Flags
yarn.installFlags
defined in options)updated
or fetched
event from
shipit-deploy or by a custom
yarn.triggerEvent
as mentioned above.)MIT
FAQs
yarn tasks for shipit.
The npm package shipit-yarn receives a total of 65 weekly downloads. As such, shipit-yarn popularity was classified as not popular.
We found that shipit-yarn demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.