micromatch
GHSA-pjwm-rvh2-c87w
| micromatch | GHSA-pjwm-rvh2-c87w | |
|---|---|---|
| 4 | 8 | |
| 2,618 | - | |
| 0.8% | - | |
| 4.4 | - | |
| 14 days ago | - | |
| JavaScript | ||
| MIT License | - |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
micromatch
-
A CLI for developing in monorepos, not building them
Packages on the RHS can contain wildcards, but must be escaped with brackets if so. We use micromatch for matching. Refer to their documentation for questions on matching behavior and available functionality.
-
Control your npm dependencies
All of the downloads are from an old version of https://github.com/micromatch/micromatch.
-
NPM – is-even, 160k weekly downloads
https://github.com/i-voted-for-trump/
> i-voted-for-trump
> This is a joke. You'll only see this org if you are attempting to troll me about repositories I created when I was learning to program.
> is-odd
> I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch. I've done a few other things since: https://xn--gith-tc7a
-
BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
Since then they've made things that are IMO quite useful, like enquirer, micromatch, and remarkable.
GHSA-pjwm-rvh2-c87w
-
Attack Simulator for SolarWinds, Codecov, and ua-parser-js breaches
The SUNSPOT malware, Codecov breach, and lot of compromised open-source packages (like was the case with ua-parser-js) target the CI/ CD pipeline to modify release build or exfiltrate credentials.
- Embedded malware in ua-parser-js - critical severity
- Embedded malware in ua-parser-JS (NPM package)
-
PSA: Tor.com was hacked and is currently spreading malware
I think you are misunderstanding the attack vector in the article you linked. This isn't the same thing we were discussing, please see https://github.com/advisories/GHSA-pjwm-rvh2-c87w. This was not a compromise designed to go after the visitors of the website so far as I can tell (and even if it were, it couldn't do much except possibly steal a password if you entered it on a compromised site or steal cookie data). This was designed to target people who were using the library in their software, aka, it was targeting the build-chain of the developers, and many devs and companies as a result had computers compromised when the updated their versions, which caused the compromised version to download to their computers.
- Supply-chain attack on NPM Package UAParser, which has millions of daily downloads
- The npm package ua-parser-js had three versions (0.7.29, 0.8.0, 1.0.0) published with malicious code.
- Embedded crypto miner in ua-parser-JS
-
BREAKING!! NPM package ‘ua-parser-js’ with more than 7M weekly download is compromised
Github has published an advisory for the package https://github.com/advisories/GHSA-pjwm-rvh2-c87w
What are some alternatives?
picomatch - Blazing fast and accurate glob matcher written JavaScript, with no dependencies and full support for standard and extended Bash glob features, including braces, extglobs, POSIX brackets, and regular expressions. Used by GraphQL, Jest, Astro, Snowpack, Storybook, bulma, Serverless, fdir, Netlify, AWS Amplify, Revogrid, rollup, routify, open-wc, imba, ava, docusaurus, fast-glob, globby, chokidar, anymatch, cloudflare/miniflare, pts, and more than 5 million projects! Please follow picomatch's author: https://github.com/jonschlinkert
npm-force-resolutions - Force npm to install a specific transitive dependency version
is-even - I created this in 2014, when I was learning how to program.
is-mobile - Check if mobile browser, based on useragent string.
emoji-regex - A regular expression to match all Emoji-only symbols as per the Unicode Standard.
is-number - JavaScript/Node.js utility. Returns `true` if the value is a number or string number. Useful for checking regex match results, user input, parsed strings, etc.
Dapper - Dapper - a simple object mapper for .Net [Moved to: https://github.com/DapperLib/Dapper]
is-odd - I created this in 2014, the year I learned how to program. All of the downloads are from an old version of https://github.com/micromatch/micromatch. I've done a few other things since: https://github.com/jonschlinkert.
NUnit - NUnit Framework
enquirer - Stylish, intuitive and user-friendly prompts, for Node.js. Used by eslint, webpack, yarn, pm2, pnpm, RedwoodJS, FactorJS, salesforce, Cypress, Google Lighthouse, Generate, tencent cloudbase, lint-staged, gluegun, hygen, hardhat, AWS Amplify, GitHub Actions Toolkit, @airbnb/nimbus, and many others! Please follow Enquirer's author: https://github.com/jonschlinkert
ua-parser-js - UAParser.js - Free & open-source JavaScript library to detect user's Browser, Engine, OS, CPU, and Device type/model. Runs either in browser (client-side) or node.js (server-side).