
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
aa-inactivity
Advanced tools
This is a player activity monitoring plugin app for Alliance Auth (AA).
Users are notified on Alliance Auth. If you want those notifications to be forwarded as DM on Discord, please check out this app: Discord Notify.
A user creating a new leave of absence request:

A manager reviewing a leave of absence request:

A manager looking through the list of currently inactive and notified users:

This app needs Member Audit to function. Please make sure it is installed before continuing.
Make sure you are in the virtual environment (venv) of your Alliance Auth installation. Then install the newest release from PyPI:
pip install aa-inactivity
Add inactivity to your INSTALLED_APPS, and add the following task definition:
CELERYBEAT_SCHEDULE['inactivity_check_inactivity'] = {
'task': 'inactivity.tasks.check_inactivity',
'schedule': crontab(minute=0, hour=0),
}
Run migrations:
python manage.py migrate
python manage.py collectstatic
Restart your supervisor services for Auth
This app uses permissions to control access to features.
| Name | Purpose | Code |
|---|---|---|
| general - Can access this app | Enabling the app for a user. This permission should be enabled for everyone who is allowed to use the app | basic_access |
| general - Can manage leave of absence requests | Allows a user to approve/deny loa requests. | manage_leave |
FAQs
Activity monitoring app for Alliance Auth.
We found that aa-inactivity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.