
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
Tag-driven git index
It does not seem possible to get commits info w/o repo cloning. This limitation brings a significant performance impact on conventional-commits driven release flows (especially if git notes API is not supported by VCS). But what if we'd have a side index with web-hooks triggers instead. Let's find out.
— Looks like a kv-storage based on git tags. This is madness.
— True.
As a part of «how self-sufficient git is» research.
yarn add tagtower
import {createTower} from 'tagtower'
const tower = createTower({
url: 'https://<token>github.com/git/repo.git',
branch: 'tagtower', // Branch for storing tags. Defaults to 'tagtower'
temp: './temp', // Dir to hold temporary git channels. Defaults to fs.mkdtemp(path.join(os.tmpdir(), 'tempy-tagtower-'))
committerName: 'Foo Bar', // Username and email to sign annotaged git tags
committerEmail: 'foo@bar.baz', // Defaults to Semrel Extra Bot <semrel-extra-bot@hotmail.com>
format: v => v + '', // Opt value formatter. Defaults to JSON.stringify
parse: v => v, // Opt parser. Defaults to JSON.parse
filter: v => v % 2 // Opt low level filter (applied before parse). Defaults to () => true
})
const id: string = 'some@tag'
const data: Record<string, any> = {
hash: '3f9f0a88b411a8932bce289a3dd498d70a4dc96c',
author: 'Anton Golub <antongolub@antongolub.com>',
message: 'feat: initial feat'
}
await tower.create(id, data) // stores entry to the specified remote
await tower.read(id) // returns found TEntry | null
await tower.read() // if tag is empty, returns TEntry[]
await tower.update(id, data) // just a shortcut for delete & create
await tower.delete(id) // void
FAQs
Tag-driven git index
We found that tagtower demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.