event-stream
Sobelow
| event-stream | Sobelow | |
|---|---|---|
| 5 | 2 | |
| 2,157 | 1,608 | |
| - | 0.8% | |
| 0.0 | 5.0 | |
| over 5 years ago | 27 days ago | |
| JavaScript | Elixir | |
| MIT License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
event-stream
-
I gave commit rights to someone I didn't know
Another possible outcome of "I gave commit rights to someone I didn't know": https://github.com/dominictarr/event-stream/issues/116
- Looking for open source Python lite wallet or Payment Processor with unified API for BTC, LTC, ETH, XMR, maybe others
-
What NPM Should Do Today to Stop a New Colors Attack Tomorrow
Whole npm ecosystem is so fragile.
Remember event-stream[1]? Did we learned something from that? Yes, we might. So was it improved? Never. People are still installing 'new' colors package and wondering why its texts are broken.
What if he uploaded malicious code rather than just just gibberish?
[1]: https://github.com/dominictarr/event-stream/issues/116
- NPM Audit: Broken by Design
-
Researcher hacks over 35 tech firms by creating public NPM packages
foo-bar version 1.0 depends on bada-boom 1.0 which depends on bada-bing 1.0. Now you update to foo-bar 1.1 because of some critical update, which in itself now depends on bada-boom 2.0 and bada-bing 2.0. But unbeknownst to you and the author of foo-bar, the bada-boom and bada-bing project was taken over by another maintainer who made an update, but also added some trojan horse code to specifically attack certain users, which was obfuscated and remained undetected. Which has happened before - not just browser extensions are affected by malicious attackers taking over useful projects.
Sobelow
-
I gave commit rights to someone I didn't know
I created/maintained a popular project for years[^1], and recently passed ownership to someone else. It's been great seeing issues resolve, PRs merge, etc, after languishing for a while :)
[^1]: https://github.com/nccgroup/sobelow
-
Are there any static analysis tools that can be used to gauge security holes and privacy risk on open source software?
There is one for elixir that I plan on using for elixir based projects https://github.com/nccgroup/sobelow
What are some alternatives?
enquirer - Stylish, intuitive and user-friendly prompts, for Node.js. Used by eslint, webpack, yarn, pm2, pnpm, RedwoodJS, FactorJS, salesforce, Cypress, Google Lighthouse, Generate, tencent cloudbase, lint-staged, gluegun, hygen, hardhat, AWS Amplify, GitHub Actions Toolkit, @airbnb/nimbus, and many others! Please follow Enquirer's author: https://github.com/jonschlinkert
petal_components - Phoenix + Live View HEEX Components
cli - the package manager for JavaScript
PhoenixBootstrapForm - Bootstrap 4 Forms for Phoenix/Elixir Applications
pkg-vuln-collab-space - Project for work on improved Package Vulnerability Management & Reporting
Tarams - Cast and validate external data and request parameters for Elixir and Phoenix
proposal-built-in-modules
PinWork - PinWork(Pinterest for bloggers) built with ❤️ using Angular2 (4.0.0)
django-money - Money fields for Django forms and models.
Formulator - A form library for Phoenix
colors.js - get colors in your node.js console
querie - Compose Ecto query from the client side