
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
mina-rsync
Advanced tools
Deploy with Rsync to your server from any local (or remote) repository when using Mina.
Saves you from having to install Git on your production machine and allows you to customize which files you want to deploy. Also allows you to easily precompile things on your local machine before deploying.
--exclude options.Install with:
gem install mina-rsync
Require it at the top of your Minafile (or config/deploy.rb):
require "mina/rsync"
Set some rsync_options to your liking:
set :rsync_options, %w[--recursive --delete --delete-excluded --exclude .git*]
Then invoke Mina::Rsync's tasks from your deploy task:
task :deploy do
deploy do
invoke "rsync:deploy"
end
end
And after setting regular Mina options, deploy as usual!
mina deploy
rsync_stage (defaults to tmp/deploy) on your local machine.branch variable (defaults to master).rsync_cache (defaults to shared/deploy) on the server.After that, Mina takes over and runs its usual tasks and symlinking.
If you don't want to deploy everything you've committed to your repository, pass some --exclude options to Rsync:
set :rsync_options, %w[
--recursive --delete --delete-excluded
--exclude .git*
--exclude /config/database.yml
--exclude /test/***
]
Mina::Rsync runs rsync:stage before rsyncing. Hook to that like this:
task :precompile do
Dir.chdir settings.rsync_stage do
system "rake", "assets:precompile"
end
end
task "rsync:stage" do
invoke "precompile"
end
Set Mina variables with set name, value.
| Name | Default | Description |
|---|---|---|
| repository | . | The path or URL to a Git repository to clone from. |
| branch | master | The Git branch to checkout. |
| rsync_stage | tmp/deploy | Path where to clone your repository for staging, checkouting and rsyncing. Can be both relative or absolute. |
| rsync_cache | shared/deploy | Path where to cache your repository on the server to avoid rsyncing from scratch each time. Can be both relative or absolute. |
| rsync_options | [] | Array of options to pass to rsync. |
Mina::Rsync is released under a Lesser GNU Affero General Public License, which in summary means:
For more convoluted language, see the LICENSE file.
Andri Möll made this happen.
Monday Calendar was the reason I needed this.
If you find Mina::Rsync needs improving, please don't hesitate to type to me now at andri@dot.ee or create an issue online.
FAQs
Unknown package
We found that mina-rsync demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.