Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
ssb-git-repo
Advanced tools
Host git repos in secure-scuttlebutt
var ssbGit = require('ssb-git-repo')
var repoId = '%CBeVWA9eYt6OhJDXFtqas6kWb5LwaJxYtfwDazKvh4U=.sha256'
// get a single repo:
ssbGit.getRepo(sbot, repoId, function (err, repo) {
if (err) throw err
// do something with the repo
})
ssbGit.createRepo(sbot[, options], cb(err, repo))
Create a repo. Publishes a message announcing the new repo.
sbot
: a scuttlebot or ssb-client objectoptions.upstream
(ssbGit.Repo
or MsgId): upstream repo (of which
the new repo will be a fork)options.name
(string): name to give the repooptions.live
: keep the repo updated as changes are pushed to itoptions.output
: stream for logging stuff tocb
: function called when the repo is createderr
: error creating the repo, if anyrepo
: ssbGit.Repo
object for the new repossbGit.getRepo(sbot, msgOrId[, options], cb(err, repo))
Get a repo.
sbot
: a scuttlebot or ssb-client objectmsgOrId
: SSB message that started the repo, or the ID of itoptions.live
: keep the repo updated as changes are pushed to itoptions.output
: stream for logging stuff tocb
: function called when the repo is retrievederr
: error retrieving the repo, if anyrepo
: ssbGit.Repo
object for the retrieved repossbGit.repos(sbot, options): source(repo)
Get repos from the feed
sbot
: a scuttlebot or ssb-client objectoptions
: options to pass to sbot.createFeedStream
repo
: ssbGit.Repo
objectssbGit.Repo
An abstract-pull-git-repo-compliant git repo object. Additional methods:
repo.close(cb(err))
Close the repo's update stream.
cb
: function called when the repo's stream is closederr
: error closing the repo, if anyrepo.getHead(cb(err, head))
Get the repo's HEAD, i.e. the "default branch" ref, e.g. `"refs/heads/master"
repo.hasObjectQuick(hash) : has
Check for the presence of a commit hash, with possible false negatives.
hash
(sha1): the commit id to checkhas
(boolean): true if the commit is presentThis will only show an object as present if it was pushed in ssb-git-repo
= v1.9.0.
{ type: 'git-repo' }
Creates a git repo. Note that you can actually push git objects to any message
in your feed, but the git-repo
type is here to declare that a message will be
for a git repo. It may have properties added later.
{
type: 'git-update',
repo: MsgId,
repoBranch: [ MsgId ]?,
refs: { <ref>: String|null }?,
packs: [ BlobLink ]?,
indexes: [ BlobLink ]?,
head: string?,
commits: [ { sha1: String, title: String } ]?,
commits_more: Number?,
num_objects: Number?,
object_ids: [ String ]?,
}
Updates a repo. Published as a result of git push
.
repo
: id of a message (expected of type git-repo
) identifying the reporepoBranch
: ids of latest concurrent previous git-update messages.
Use to indicate causal order.refs
: updates to the repo's refs. a map of ref names to git sha1 hashes.
e.g. { 'refs/heads/master': commitId }
packs
: links to git packfiles being added to the repoindexes
: links to index files for the packfiles in packs
head
: value of the HEAD symref, i.e. the default branch, e.g.
"refs/heads/master"
commits
: array of info about commits that are included in packs
, for
display purposescommits\_more
: number of commits included in packs
but not in commits
num_objects
: number of objects included in packs
object_ids
: sha1 hashes of git objects included in packs
, other than
commit ids mentioned in commits
. If not all can be included in the array
because of the message size limit, omit this property instead of truncating
the array.Copyright (c) 2016 Charles Lehner
Usage of the works is permitted provided that this instrument is retained with the works, so that any entity that uses the works is notified of this instrument.
DISCLAIMER: THE WORKS ARE WITHOUT WARRANTY.
FAQs
git repos in secure-scuttlebutt
The npm package ssb-git-repo receives a total of 14 weekly downloads. As such, ssb-git-repo popularity was classified as not popular.
We found that ssb-git-repo demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.