Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Dangermattic
builds on Danger on Ruby and is essentially a collection of Danger plugins. Its goal is to provide customisable checks and common utilities to help perform checks on Pull Requests, from simple routine validations to more sophisticated ones.
Add to your project's Gemfile
gem 'danger-dangermattic', git: 'https://github.com/Automattic/dangermattic'
Once the main Gem is installed, all Dangermattic plugins are available in your Dangerfile
under their corresponding namespace. A few examples:
manifest_pr_checker
- Plugin to check if changes on a manifest file (i.e. Gemfile
, Podfile
) has a corresponding change in a lock file (i.e. Gemfile.lock
, Podfile.lock
)
# Reports a warning if the Gemfile was changed but the Gemfile.lock wasn't
manifest_pr_checker.check_gemfile_lock_updated
milestone_checker
- Plugin for performing checks on a milestone associated with a pull request
# Checks if the pull request's milestone is due in 3 days or less, reporting a warning if that's the case
milestone_checker.check_milestone_due_date(days_before_due: 3)
pr_size_checker
- Plugin to check the size of a Pull Request content and text body
# Reports a warning if a pull request diff size is greater than 300
pr_size_checker.check_diff_size(max_size: 300)
view_changes_checker
- Detects view changes in a PR and reports a warning if there are no attached screenshots
# Reports a warning if a pull request changing views doesn't have a screenshot
view_changes_checker.check
All available plugins are defined here: https://github.com/Automattic/dangermattic/tree/trunk/lib/dangermattic/plugins
Dangermattic also provides some useful reusable GitHub workflows. For more information on available workflows and how to use them, please refer to the Workflows README.
bundle install
to setup dependenciesbundle exec rake
to run the all the tests, RuboCop and Danger Lintbundle exec rake specs
/ bundle exec rspec
to run only the unit testsbundle exec rake lint
to run only the linting tasks: RuboCop and Danger Lintbundle exec guard
to automatically have tests run as you make changes.bundle exec yard doc
. The documentation is generated locally in the yard-doc/
folder.Adding a new plugin to Dangermattic is very simple: just create a new subclass of Danger::Plugin
inside ./lib/dangermattic/plugins/
, similarly to the other classes you'll find there:
module Danger
class MyNewPluginChecker < Plugin
def check_method(param:)
# ...
end
end
end
It will be automatically imported, exposed by Dangermattic's Gem and visible in your Dangerfile
once you add it as a dependency:
# In a Dangerfile
my_new_plugin_checker.check_method(param: my_param_value)
Please follow the existing naming convention for validation and check plugins: classes end with a *Checker
suffix and the main validation methods are named with a check_*
prefix.
To create a new release of the Dangermattic gem, use the new_release
Rake task:
bundle exec rake new_release
This task will:
CHANGELOG.md
file to get the latest version and pending changes.VERSION
constant in the gem_version.rb
file.CHANGELOG.md
file with the new version.After running the task, follow the instructions provided to complete the release process:
trunk
branch, using the changelog content provided.FAQs
Unknown package
We found that danger-dangermattic demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.