Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Convert GitHub project releases to Archlinux package, with autoupdate.
A lot of packages in Archlinux's AUR are just a single PKGBUILD file that downloads the latest release from GitHub, and many of them are human-maintained, which means that they are not updated as soon as a new release is published.
This script provides an alternative. If a GitHub project has binary releases, it can automatically download a release tarball, create a PKGBUILD file, makepkg, and install it. It can also rebuild the package if a new release is found.
pipx install arch-github-package
pipx installs the package in a virtualenv, so it doesn't pollute your system.
You can also use pip:
pip install --user --break-system-packages arch-github-package
(This will install the package in your user site-packages, not really breaking system packages.)
agp install <github-repo>
Example:
agp install cortesi/devd
How does it work:
It looks for the latest release on GitHub.
It tries to find a pre-built package for your system, by looking for keywords like "linux", "x86-64", "x86_64", "amd64", "gnu" in the release assets.
It downloads the tarball, extracts it, and tries to dertermine which file goes where. E.g.:
/usr/bin
./usr/share/man
./usr/share/doc/<package-name>
./usr/share/licenses/<package-name>
.It creates a PKGBUILD file, and runs makepkg -si
to build and install it.
The package name is <github-project-name>-github
. E.g., ortesi/devd
becomes
devd-github
.
agp list
agp upgrade
You can also use agp upgrade <package-name>
to upgrade a single package.
Note: if you run this command repeatively in quick succession, it will hit GitHub's rate limit for anonymous API access.
agp uninstall <package-name>
If you uninstall an -github package with pacman
, it will still be listed by agp list
.
So remember to use agp uninstall
to remove it.
Metadata is stored under ~/.local/share/arch-github-package
.
FAQs
Convert GitHub project releases to Archlinux package, with autoupdate.
We found that arch-github-package demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.