
Research
/Security News
Trivy Under Attack Again: Widespread GitHub Actions Tag Compromise Exposes CI/CD Secrets
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.
staged-git-files
Advanced tools
This module returns an array of staged files and their status acording to git.
Download
npm install staged-git-files
In Code
var sgf = require("staged-git-files");
sgf(function(err, results){
//WHAT EVER YOU SO PLEASE
});
Example Results
[
{
"filename": "package.json",
"status": "Added"
},
{
"filename": "readme.md",
"status": "Modified"
},
{
"filename": "index.js",
"status": "Renamed"
}
]
Get a list of staged git files
Get head that will be used in the diff to ID which files are waiting to be staged.
This is a proxy for fs.readFile with one change. The filename will be relative to the sgf.cwd
Boolean that flips logging on and off. By default this is false. If true, all git commands will be console logged.
If true, include content will add a content or err param to the file object.
The current working directory. AKA: where the .git folder you care about is.
SGF-Status (git status code)
The 'simple-git' package is a lightweight interface for running Git commands in any Node.js application. It provides a more comprehensive set of Git functionalities compared to 'staged-git-files', including committing, pushing, and pulling changes, as well as retrieving the status of the repository.
The 'isomorphic-git' package is a pure JavaScript implementation of Git that works in both Node.js and browser environments. It offers a wide range of Git functionalities, including cloning repositories, committing changes, and managing branches. It is more versatile than 'staged-git-files' but also more complex to use.
The 'nodegit' package is a native Node.js binding to the libgit2 library, providing a full suite of Git functionalities. It allows for more advanced Git operations, such as merging branches and handling submodules, making it more powerful but also more complex than 'staged-git-files'.
FAQs
get a list of staged git files and their status
The npm package staged-git-files receives a total of 377,358 weekly downloads. As such, staged-git-files popularity was classified as popular.
We found that staged-git-files demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Attackers compromised Trivy GitHub Actions by force-updating tags to deliver malware, exposing CI/CD secrets across affected pipelines.

Security News
ENISA’s new package manager advisory outlines the dependency security practices companies will need to demonstrate as the EU’s Cyber Resilience Act begins enforcing software supply chain requirements.

Research
/Security News
We identified over 20 additional malicious extensions, along with over 20 related sleeper extensions, some of which have already been weaponized.