
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
This project packages the clang-tidy
utility as a Python package. It allows you to install clang-tidy
directly from PyPI:
python -m pip install clang-tidy
This projects intends to release a new PyPI package for each major and minor release of clang-tidy
.
You can use pipx
to run clang-tidy, as well. For example, pipx run clang-tidy <args>
will run clang-tidy without any previous install required on any machine with pipx (including all default GitHub Actions / Azure runners, avoiding requiring a pre-install step or even actions/setup-python
).
The clang-tidy-wheel repository provides the logic to build and publish binary wheels of the clang-tidy
utility.
In order to add a new release, the following steps are necessary:
On manual triggers, the following input variables are available:
use_qemu
: Whether to build targets that require emulation (default: true
)llvm_version
: Override the LLVM version (default: ""
)wheel_version
: Override the wheel packaging version (default "0"
)deploy_to_testpypi
: Whether to deploy to TestPyPI instead of PyPI (default: false
)The repository with the precommit hook is automatically updated using a scheduled Github Actions workflow.
This repository extends the great work of several other projects:
clang-tidy
itself is provided by the LLVM project under the Apache 2.0 License with LLVM exceptions.clang-tidy
.scikit-build
packaging examples of CMake and Ninja were very helpful in packaging clang-tidy
.We are grateful for the generous provisioning with CI resources that GitHub currently offers to Open Source projects.
To see which clang-tidy binary the package is using
you can set CLANG_TIDY_WHEEL_VERBOSE
to 1
in your environment.
FAQs
Clang-tidy is an LLVM-based code analyser tool
We found that clang-tidy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.