Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This gem provides the ability to easily manage your change logs. Commit changes alongside change log files to easily track them without worry, then just release them whenever to automatically create a new CHANGELOG.md file.
As an additional feature, Releaseko is integrated into the gem as it feels like Releaseko is very coupled with Changelogko. It is also just a simple feature that just automatically updates metadata/app-version
, releases change logs through Changelogko, then push.
Use bundler
to install the gem.
gem 'changelogko', git: 'https://github.com/tieeeeen1994/changelogko'
Then:
$ bundle install
Refer to:
$ bundle exec changelogko -h
or
$ bundle exec cko -h
Adding a .changelogko
file in the root of the working directory will allow to automatically append the contents of the file as options to every changelogko
(or cko
) command. For example, assume the .changelogko
file contains:
--no-archive
For every changelogko
command, it will automatically append --no-archive
, as such: bundle exec changelogko -r --no-archive
.
Changelogko will create the needed files if they don't exist yet.
Refer to:
$ bundle exec releaseko -h
or
$ bundle exec rko -h
Releaseko looks for metadata/app-version
for the project's versioning. It will automatically increment this file based on mode.
The original author of this gem is @neume, then further enhanced by @tieeeeen1994.
FAQs
Unknown package
We found that changelogko demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.