November 2022 Summaries

Socket has introduced a preview of its new command-line interface (CLI) tool, designed to complement its existing GitHub integration by offering a more flexible way for developers to interact with the platform, especially those using different source code management systems like GitLab or BitBucket or those preferring command line operations. The preview, which some might consider a beta, includes two primary commands: `socket report create`, which generates a Project Health Report by analyzing project dependencies without uploading sensitive files, and `socket info`, which provides insights into supply chain risks of specific package versions. The CLI supports various flags for output customization, such as JSON or markdown, and requires an API key for use, which can be obtained by contacting the Socket team. Future updates are planned based on user feedback, with frequent iterations to enhance functionality.

A community of Chinese developers known as 'ApacheCN' is utilizing platforms like GitHub and npm to store thousands of eBooks, some of which contain content from banned websites such as 'The Economist,' as a means to circumvent Chinese censorship. These eBooks, along with the 3,387 npm packages published by a user named 'wizardforcel,' vary widely in content, including Chinese translations of developer documentation and potentially pirated works, raising questions about copyright and legality. ApacheCN, which claims to be a non-profit project focused on document translation, has previously been associated with sending unsolicited emails, and its activities blur the lines between sharing information and engaging in online piracy. Some of the content, including a repository with sexist undertones, adds to the controversy surrounding the group's use of open-source platforms, highlighting the challenges these practices pose to maintaining software hygiene in the open-source ecosystem.