npmpublish.yml

[ericramos1980]

name: Node.js Package

on:
release:
types: [created]

jobs:
build:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v1
with:
node-version: 12
- run: npm ci
- run: npm test

publish-npm:
needs: build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v1
with:
node-version: 12
registry-url: https://registry.npmjs.org/
- run: npm ci
- run: npm publish
env:
NODE_AUTH_TOKEN: ${{8e8d00fe-5b2e-4c0f-8d0f-fc5a8c15e40c}}

publish-gpr:
needs: build
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v1
with:
node-version: 12
registry-url: https://npm.pkg.github.com/
scope: '@ericramos1980
- run: npm ci
- run: npm publish
env:
NODE_AUTH_TOKEN: ${{ 1e4d0db522cd0685f244c977f102905ce0c871a9}}

What / Why

n/a

References

• n/a

[ljharb]

are you trying to get the npm cli published under your personal scope?

[ljharb]

this token is now compromised; you may want to rotate it.

[ljharb]

this one too

[ljharb]

you have an extra apostrophe here.

[darcyclarke]

I believe this PR was mistakenly open, unless there's something I'm missing here. To @ljharb's points, it looks like you're going to have to rotate those NPM auth tokens now that you've shared them here.

I'll be closing this PR now.

[armano2]

@darcyclarke it seems that this is a bot or his account got hacked, he opened alot of almost same PR across a lot of repositories, that includes git, npm, codecov, nginx, electron list go on

in some of them he is also is trying to change/replace licenses with his name or create some weird files

eg.
https://github.com/nginx/nginx/pull/49/files
#785
git/git#704
gitcoinco/web#5911
indutny/bn.js#240
ethjs/ethjs#35
kubernetes/website#16811

this list goes on