
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
simple-semantic-config
Advanced tools
Simple semantic-release shareable config to publish npm packages
semantic-release shareable config to publish npm packages with simple commit rules
This is a shareable config to publish npm packages with simple commit rules bases on
angular
preset of commit-analyzer plugin with following change:
docs
, chore
and refactor
commit types yield patch version.
Thus pretty much any correctly formatted commit message yields new version.
$ yarn add --dev "simple-semantic-config"
The shareable config can be configured in the semantic-release configuration file or package.json:
{
"release": {
"extends": "simple-semantic-config"
}
}
Figures out new version according to semantic-release configuration, and writes it to build/.version file.
Example: BRANCH=master yarn simple-semantic-release-pre
OR
ALLOW_FAILING=false BRANCH=development yarn simple-semantic-release-pre
OR
OUT_DIR=tmp BRANCH=master yarn simple-semantic-release-pre
This requires having write Git access to repo specified in package.json, you can set it by exporting GH_TOKEN env var with: export GH_TOKEN=my-key
When it's run in CircleCI build context it uses CIRCLE_BRANCH so specifying BRANCH is not needed there:
yarn simple-semantic-release-pre
is enough.
semantic-release
takes previous versions info from Github tags of origin
remote, so when running it from local fork switch origin to upstream to get the correct new version:
git remote rm origin
git remote add origin git@github.com:upstream/my-project.git
BRANCH=master yarn simple-semantic-release-pre
git remote rm origin
git remote add origin git@github.com:my-account/my-project.git
FAQs
Simple semantic-release shareable config to publish npm packages
The npm package simple-semantic-config receives a total of 87 weekly downloads. As such, simple-semantic-config popularity was classified as not popular.
We found that simple-semantic-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.