
Security News
Nx npm Packages Compromised in Supply Chain Attack Weaponizing AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
I want to user other people's code. Most of the time, I don't want to use git submodules
. For those times, I wrote morsel
.
Point morsel
at a git repository and tell it which files you want. It'll fetch them for you and place them into your source tree.
There is no dependency management system for Cocoa development. Everytime I want to use a new library, my options are:
Clone the repository. Figure out which files I need. Copy them into my source tree.
Add a git submodule.
Both options are annoying in their own way. Inspired by bundler and homebrew, I present morsel
.
morsel
is available as a RubyGem
$ gem install morsel
Create a Morselfile
in your project's root that looks something like this:
morsel 'jsonkit' do |m|
m.url = 'https://github.com/johnezang/JSONKit.git'
m.files = %w{
JSONKit.h
JSONKit.m
}
end
Then run morsel install
. It'll clone the repos into ~/.morsel/repos
and then copy your desired files into a morsels
directory in your project's root:
$ find .
.
./Morselfile
./morsels
./morsels/jsonkit
./morsels/jsonkit/JSONKit.h
./morsels/jsonkit/JSONKit.m
That's it!
First, the whole thing is half-baked, so fleshing it out a bit will be nice.
Then, it's annoying to have to define the url and files for each morsel. An ideal Morselfile
would look something like this:
morsel 'jsonkit', :sha => 'c9ffd8f823e68df96fa2f87185bee861984ef637'
morsel 'asihttprequest', :tag => 'v1.8'
That'll require some homebrew-style package management.
FAQs
Unknown package
We found that morsel demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.