|
4 | 4 | A free service by [Checkmarx](https://checkmarx.com/) for the Open Source community that scans popular packages and alerts in cases there is a suspicion those packages' accounts were hacked.
|
5 | 5 |
|
6 | 6 | ### The Need
|
| 7 | + |
7 | 8 | Recent package takeover incidents such as [coa](https://checkmarx.com/blog/attackers-write-bugs-as-well/) and [ua-parser-js](https://checkmarx.com/blog/uaparser-js-attack-preparations/) have stressed the need for an alarm system to alert developers and users.
|
8 | 9 |
|
9 | 10 | Learning the lessons of these supply chain incidents we've created **ChainAlert**, a monitoring service that will help minimize the damages from those attacks by closing the gap between takeover to detection and mitigation.
|
10 | 11 |
|
| 12 | + |
11 | 13 | ### What It Does?
|
12 | 14 |
|
13 |
| -ChainAlert service monitors new releases of packages and analyze: |
14 |
| -- Newly added auto install scripts such as `install`, `preinstall`, `postinstall` scripts |
15 |
| -- Inconsistent package version compared the linked VCS git tags |
| 15 | +ChainAlert cloud service continuously monitor and analyse new releases of packages: |
| 16 | +- Detection of newly added auto install scripts such as `install`, `preinstall`, `postinstall` |
| 17 | +- Checking the consistency of the version and if presented in the package's linked git repository tags |
16 | 18 |
|
| 19 | + |
17 | 20 |
|
18 |
| -Once ChainAlert detect one of these suspicious activities, it will open automatic GitHub issues on: |
19 |
| -- The package's GitHub repo, to notify the maintainers of that activity |
20 |
| -- Any package dependents' GitHub repo who's opted-in with this github action |
21 | 21 |
|
| 22 | +If ChainAlert finds a suspicious activity of a package, it will automatically open GitHub issues on: |
| 23 | +- The package's linked GitHub repo, to notify the maintainers of that activity |
| 24 | +- Any package dependents' GitHub repo who's opted-in via [this GitHub action](https://github.com/marketplace/actions/chainalert) |
| 25 | + |
| 26 | + |
22 | 27 | 
|
23 | 28 |
|
24 | 29 |
|
25 | 30 | ### How Do I Opt In?
|
26 | 31 |
|
27 |
| -Simply add the following workflow to your `.github/workflows` folder, we will take it from there: |
| 32 | +You need to add our [GitHub action](https://github.com/marketplace/actions/chainalert) to your project. If you already have an existing workflow, add the following step: |
28 | 33 |
|
29 | 34 | ```yml
|
30 |
| -name: "ChainAlert" |
| 35 | + - uses: checkmarx/chainalert-github-action@v1 |
| 36 | +``` |
31 | 37 |
|
| 38 | +Alternatively, create a dedicated workflow file under `.github/workflows/chainalert.yml` |
| 39 | + |
| 40 | +```yml |
| 41 | +name: ChainAlert |
32 | 42 | on:
|
33 | 43 | push:
|
34 |
| - # Run when the master is changed |
35 | 44 | branches: [ master ]
|
36 |
| - schedule: |
37 |
| - # Run every day at midnight |
38 |
| - - cron: '0 1 * * *' |
39 |
| - |
40 | 45 | jobs:
|
41 | 46 | chainalert:
|
42 |
| - name: ChainAlert |
43 | 47 | runs-on: ubuntu-latest
|
44 | 48 | steps:
|
45 |
| - - uses: actions/checkout@v2 |
46 |
| - - uses: checkmarx/chainalert-github-action@master |
| 49 | + - uses: actions/checkout@v2 |
| 50 | + - uses: checkmarx/chainalert-github-action@v1 |
47 | 51 | ```
|
48 |
| -- 💡 This service is only available for public GitHub projects |
| 52 | +- 💡 This action and service are only available for public GitHub projects |
49 | 53 |
|
50 | 54 |
|
51 | 55 | ### Features
|
|
58 | 62 |
|
59 | 63 |
|
60 | 64 | ### Contact
|
61 |
| -For any further question please feel free to open an issue or contact us at <@checkmarx.com> |
| 65 | +For any further question please feel free to open an issue or contact us at supplychainsecurity@checkmarx.com |
62 | 66 |
|
0 commit comments