Skip to content

Commit c7d92d3

Browse files
author
jossef
committed
docs: updated readme
1 parent 9d03e78 commit c7d92d3

File tree

1 file changed

+22
-18
lines changed

1 file changed

+22
-18
lines changed

README.md

Lines changed: 22 additions & 18 deletions
Original file line numberDiff line numberDiff line change
@@ -4,48 +4,52 @@
44
A free service by [Checkmarx](https://checkmarx.com/) for the Open Source community that scans popular packages and alerts in cases there is a suspicion those packages' accounts were hacked.
55

66
### The Need
7+
78
Recent package takeover incidents such as [coa](https://checkmarx.com/blog/attackers-write-bugs-as-well/) and [ua-parser-js](https://checkmarx.com/blog/uaparser-js-attack-preparations/) have stressed the need for an alarm system to alert developers and users.
89

910
Learning the lessons of these supply chain incidents we've created **ChainAlert**, a monitoring service that will help minimize the damages from those attacks by closing the gap between takeover to detection and mitigation.
1011

12+
1113
### What It Does?
1214

13-
ChainAlert service monitors new releases of packages and analyze:
14-
- Newly added auto install scripts such as `install`, `preinstall`, `postinstall` scripts
15-
- Inconsistent package version compared the linked VCS git tags
15+
ChainAlert cloud service continuously monitor and analyse new releases of packages:
16+
- Detection of newly added auto install scripts such as `install`, `preinstall`, `postinstall`
17+
- Checking the consistency of the version and if presented in the package's linked git repository tags
1618

19+
![Group 468](https://user-images.githubusercontent.com/1287098/144894054-1ca132cf-e3f2-448a-bfdb-d04b00cbd02c.png)
1720

18-
Once ChainAlert detect one of these suspicious activities, it will open automatic GitHub issues on:
19-
- The package's GitHub repo, to notify the maintainers of that activity
20-
- Any package dependents' GitHub repo who's opted-in with this github action
2121

22+
If ChainAlert finds a suspicious activity of a package, it will automatically open GitHub issues on:
23+
- The package's linked GitHub repo, to notify the maintainers of that activity
24+
- Any package dependents' GitHub repo who's opted-in via [this GitHub action](https://github.com/marketplace/actions/chainalert)
25+
26+
![111](https://user-images.githubusercontent.com/1287098/144894036-8b414468-8a93-464f-bbf9-6961043c91b8.png)
2227
![Frame 240](https://user-images.githubusercontent.com/1287098/144136718-200904ca-c01f-4bd8-825a-add9762e40dc.png)
2328

2429

2530
### How Do I Opt In?
2631

27-
Simply add the following workflow to your `.github/workflows` folder, we will take it from there:
32+
You need to add our [GitHub action](https://github.com/marketplace/actions/chainalert) to your project. If you already have an existing workflow, add the following step:
2833

2934
```yml
30-
name: "ChainAlert"
35+
- uses: checkmarx/chainalert-github-action@v1
36+
```
3137
38+
Alternatively, create a dedicated workflow file under `.github/workflows/chainalert.yml`
39+
40+
```yml
41+
name: ChainAlert
3242
on:
3343
push:
34-
# Run when the master is changed
3544
branches: [ master ]
36-
schedule:
37-
# Run every day at midnight
38-
- cron: '0 1 * * *'
39-
4045
jobs:
4146
chainalert:
42-
name: ChainAlert
4347
runs-on: ubuntu-latest
4448
steps:
45-
- uses: actions/checkout@v2
46-
- uses: checkmarx/chainalert-github-action@master
49+
- uses: actions/checkout@v2
50+
- uses: checkmarx/chainalert-github-action@v1
4751
```
48-
- 💡 This service is only available for public GitHub projects
52+
- 💡 This action and service are only available for public GitHub projects
4953

5054

5155
### Features
@@ -58,5 +62,5 @@ jobs:
5862

5963

6064
### Contact
61-
For any further question please feel free to open an issue or contact us at <@checkmarx.com>
65+
For any further question please feel free to open an issue or contact us at supplychainsecurity@checkmarx.com
6266

0 commit comments

Comments
 (0)