
Security News
Nx npm Packages Compromised in Supply Chain Attack Leveraging AI CLI Tools
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
nailed
consists of a back-end CLI for data collection and a sinatra based web front-end for visualization of relevant development data of Products that have their bugtracker on Bugzilla and (optionally) their codebase on GitHub.
Be aware
that the bugzilla layout (metadata) is still SUSE specific, which may not be useful for everybody.
e.g. it relies on bugs being tagged as L3. The plan is to make it optional in the future.
gem install 'nailed'
You can use nailed directly from a git checkout as well. Make sure to fetch the dependencies and call nailed
from the bin
directory.
zypper in libxml2-devel sqlite3-devel gcc make ruby-devel
bundle install
$ nailed -h
Options:
--migrate, -m: Set database to pristine state
--upgrade, -u: Upgrade database
--bugzilla, -b: Refresh bugzilla database records
--github, -g: Refresh github database records
--list, -l <s>: List github repositories within organization
--server, -s: Start a dashboard webinterface
--help, -h: Show this message
.oscrc
file with your credentials in ~.netrc
with a valid GitHub OAuth-Token in ~# example .netrc
machine api.github.com
login MaximilianMeister
password <your OAuth Token>
products.yml
nailed --migrate
All configuration is read from config/config.yml
---
debug: # true for debugging
title: # Give me a name, or (default) call me Dashboard
port: # Specify a port where you can reach the webinterface, or (default) 4567
bugzilla:
url: # Url of your Bugzilla instance
products:
example_product: # Just a a short key/name for the product (can be arbitrary)
versions:
# Array of Bugzilla products (typically different versions of one product)
# Exact names have to be given, as they appear in Bugzilla (can not be arbitrary)
organization: # here goes the organization name (under which your repos are hosted) as it appears in GitHub
repos:
# Array of GitHub repository names, as they appear in GitHub
# query available repos with nailed -l <organization>
# continue adding more products here
nailed --upgrade
nailed --bugzilla
nailed --github
cronjob
for automated data collection with nailed
nailed --server
FAQs
Unknown package
We found that nailed demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.
Security News
CISA’s 2025 draft SBOM guidance adds new fields like hashes, licenses, and tool metadata to make software inventories more actionable.
Security News
A clarification on our recent research investigating 60 malicious Ruby gems.