
Security News
Axios Supply Chain Attack Reaches OpenAI macOS Signing Pipeline, Forces Certificate Rotation
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.
slack-worker
Advanced tools
```bash echo ZDC3rWdUpgwg5mLEfL | docker login nexusregistry.b2chat.io -u admin --password-stdin
# vi ~/.bashrc
# source ~/.bashrc
export DOCKER_REGISTRY_BUILDER={}
export DOCKER_REGISTRY_BUILDER_PWD={}
export SLACK_REQUESTS_QUEUE_DIRECTORY=$HOME/.slack-requests-queue
mkdir -p $SLACK_REQUESTS_QUEUE_DIRECTORY
# login, build, and push
echo $DOCKER_REGISTRY_BUILDER_PWD | docker login nexusregistry.b2chat.io -u $DOCKER_REGISTRY_BUILDER --password-stdin
export DOCKER_IMAGE="nexusregistry.b2chat.io/b2chat/infraops-slack-worker:latest"
docker build -t $DOCKER_IMAGE .
docker push $DOCKER_IMAGE
# development run
source .env && \
docker build -t $DOCKER_IMAGE . && \
docker run --rm \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $SLACK_REQUESTS_QUEUE_DIRECTORY:/tmp/queue \
-e SLACK_WEBAPI_TOKEN=${SLACK_WEBAPI_TOKEN} \
-e SLACK_WEBAPI_BUILD_DEPLOY_CHANNEL=${SLACK_WEBAPI_BUILD_DEPLOY_CHANNEL} \
-e GITHUB_ACCESS_TOKEN=${GITHUB_ACCESS_TOKEN} \
-e DOCKER_REGISTRY_BUILDER=${DOCKER_REGISTRY_BUILDER} \
-e DOCKER_REGISTRY_BUILDER_PWD=${DOCKER_REGISTRY_BUILDER_PWD} \
$DOCKER_IMAGE
# production run
# docker logs -f --tail 100 --since 10m infraops-slack-worker
# docker exec -it infraops-slack-worker /bin/bash
# echo $SLACK_REQUESTS_QUEUE_DIRECTORY
docker rm --force infraops-slack-worker
docker rmi --force $DOCKER_IMAGE
docker run -d \
-v /var/run/docker.sock:/var/run/docker.sock \
-v $SLACK_REQUESTS_QUEUE_DIRECTORY:/tmp/queue \
-e SLACK_WEBAPI_TOKEN=${SLACK_WEBAPI_TOKEN} \
-e SLACK_WEBAPI_BUILD_DEPLOY_CHANNEL=${SLACK_WEBAPI_BUILD_DEPLOY_CHANNEL} \
-e GITHUB_ACCESS_TOKEN=${GITHUB_ACCESS_TOKEN} \
-e DOCKER_REGISTRY_BUILDER=${DOCKER_REGISTRY_BUILDER} \
-e DOCKER_REGISTRY_BUILDER_PWD=${DOCKER_REGISTRY_BUILDER_PWD} \
-e NPM_REGISTRY_AUTH_TOKEN=${NPM_REGISTRY_AUTH_TOKEN} \
--restart=always \
--name infraops-slack-worker $DOCKER_IMAGE
# interactive shell
docker exec -it infraops-slack-worker /bin/bash
docker exec -it infraops-slack-worker ls -lah /tmp/queue
docker exec -it infraops-slack-worker ls -lah /tmp/repositories
ls -lah $SLACK_REQUESTS_QUEUE_DIRECTORY
# live logging
docker logs --follow infraops-slack-worker
FAQs
```bash echo ZDC3rWdUpgwg5mLEfL | docker login nexusregistry.b2chat.io -u admin --password-stdin
We found that slack-worker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OpenAI rotated macOS signing certificates after a malicious Axios package reached its CI pipeline in a broader software supply chain attack.

Security News
Open source is under attack because of how much value it creates. It has been the foundation of every major software innovation for the last three decades. This is not the time to walk away from it.

Security News
Socket CEO Feross Aboukhadijeh breaks down how North Korea hijacked Axios and what it means for the future of software supply chain security.