
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
This gem can be used to validate that a file conforms to the Keep a Changelog standard. It does this by defining a Keep a Changelog grammar and using the treetop parsing DSL to parse a changelog file according to that grammar.
Add parse_a_changelog
to your Gemfile
and bundle install
or install it directly with:
gem install parse_a_changelog
The gem includes a binary that can be run with the changelog file as its single argument:
parse path/to/changelog
Or you can use the gem directly in your Ruby code:
result = ParseAChangelog::parse("path/to/changelog")
Finally, here is an example bash script that runs parse-a-changelog
on the current directory in a Docker container, which can be useful for including changelog validation in a CI pipeline:
#!/bin/bash -ex
docker run \
--rm \
--volume "${PWD}/CHANGELOG.md":/CHANGELOG.md \
cyberark/parse-a-changelog
We welcome contributions of all kinds to parse-a-changelog
. See our contributing guide.
Make sure you have the rspec
gem installed in your current gem set then run the tests like so:
$ rspec
..................
Finished in 0.02494 seconds (files took 0.21634 seconds to load)
18 examples, 0 failures
VERSION
file.CHANGELOG.md
into a new section using the current release version and date.CHANGELOG.md
.git tag <release-version> && git push origin --tags
gem build parse_a_changelog.gemspec
gem push parse_a_changelog-<release-version>.gem
(this may require setting up publishing credentials)The parse-a-changelog gem is licensed under Apache License 2.0 - see LICENSE
for more details.
FAQs
Unknown package
We found that parse_a_changelog demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.