bretc

Started as Jekyll, but then converted to just markdown in GitHub.

My CMS is just Github basically, you can basically read and navigate the files in Github with very little content loss:

https://github.com/bcomnes/bret.io/tree/master/src

The loose collection of build tools are wrapped up in this tool: https://github.com/bcomnes/siteup

Its deployed to Neocities with this custom action: https://github.com/bcomnes/deploy-to-neocities

My stylesheet base lives here https://github.com/bcomnes/mine.css

Majority are benign, but when a package without one adds one, you probably want to see why :)

Right now the integration is fairly slim, it just does typo squat warnings when you install a package that has a similar name to a more common package. The warning comes in the form of a comment in PRs that include additions of packages that meet this criteria.

We have a bunch of other detections listed here: https://socket.dev/npm/issue which have not been added to the GitHub App yet, but are available on a per-package basis for manual research at the moment. Over the next few release cycles we will be adding additional issue checks and warnings to the Github integration so that you can get a warning when dependencies add new capabilities, add suspicious things like analytics or install scripts or add unknown publishers to their maintainer list, or start publishing binary or obfuscated code. These will be automatically turned on and rolled out as we determine them to be not too noisy and provide interesting signals.

2. https://socket.dev/roadmap See https://socket.dev/npm/issue for analysis we have developed on a per-package basis. We are working on integrating these with our GitHub App to provide custom tailored project views into this data. More info here https://socket.dev/blog/inside-node-modules

3. It will be a paid product, but is free while it is in beta. We plan on keeping it free for open source.

We are looking into providing support for the Deno ecosystem down the road as well. The capabilities stuff they have is super great, but you lose all of that benefit for every dependency as soon as you turn it off, so we think there is probably room for this kind of analysis there. Hopefully Socket can provide a similar signal that --allow-net provides, but for all of npm!