
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
frigg-worker
Advanced tools
A worker application that listens to the frigg broker an pick up builds and build them.
A worker application that listens to the frigg broker, picks up builds and builds them.
::
virtualenv ~/frigg-worker
~/frigg-worker/bin/pip install frigg-worker
~/frigg-worker/bin/frigg-worker
::
$ frigg_worker --help
Usage: frigg_worker MODE [OPTIONS]
Options:
--dispatcher-url TEXT URL to the dispatcher, overrides settings
--dispatcher-token TEXT Token for dispatcher, overrides settings
--hq-url TEXT URL for frigg-hq, overrides settings
--hq-token TEXT Token for frigg-hq, overrides settings
--slack-url TEXT URL for incoming webhook in slack
--sentry-dsn TEXT Sentry dsn needed to connect to the sentry API
--loglevel TEXT Set log level for frigg-packages
--help Show this message and exit.
The worker has two modes builder and deployer which defines whether the worker should
build and run tests or deploy previews.
Builder
Runs tasks within a given docker container before removing the docker container and reports
to the build report API of HQ.
Deployer
Starts a docker container that will run for the amount of time specified by the task payload before running deploy tasks inside the container. The container exposes port 8000 to a port on the host system given by the task payload. The container-image is chosen from the task payload, thus, the worker trusts the task-queue to only contain tasks with allowed images. The status of the deployments is reported to the preview-deployment API of HQ.
Running frigg-worker from source
::
python -m frigg_worker.cli
--------------
MIT © frigg.io
.. |Build status| image:: https://ci.frigg.io/badges/frigg/frigg-worker/
:target: https://ci.frigg.io/frigg/frigg-worker/
.. |Coverage status| image:: https://ci.frigg.io/badges/coverage/frigg/frigg-worker/
:target: https://ci.frigg.io/frigg/frigg-worker/
FAQs
A worker application that listens to the frigg broker an pick up builds and build them.
We found that frigg-worker demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.