Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Security News
Sarah Gooding
August 28, 2024
Python has a new package manager. Astral, a startup centered around creating Python tooling, made a big splash in February when it first released uv as a drop-in alternative to pip, pip-tools, and virtualenv. The package manager is written in Rust and boasts speeds that are 10-100x faster than pip, as shown by these example metrics for installing Trio's dependencies with a warm cache.
This major update to uv moves the tool closer to realizing Astral's vision of it becoming the 'Cargo for Python.’ A few of the new feature highlights include:
The Astral team is known for its work on Ruff, a Python linter and formatter that also has a strong focus on performance. These tools constitute some of the most significant recent additions to the Python ecosystem, and the performance claims aren’t just marketing hype. Community feedback confirms that uv is notably faster than its predecessors.
“The paint isn't even dry on this stuff - it's only been out for a few hours - but this feels very promising to me,” Django co-creator Simon Wilson said. “The idea that you can install uv (a single Rust binary) and then start running all of these commands to manage Python installations and their dependencies is very appealing.”
uv was among GitHub’s trending repositories over the weekend, as the community’s excitement coalesced around its potential to replace some of Python’s more established tools. uv simplifies the experience of building with Python by reducing the number of required tools.
Astral founder Charlie Marsh recently appeared on the Bite Code podcast and explained how they to ship a series of packaging interfaces for working with Python projects and packages:
For example, for people that have used Poetry or PDM in the past, we now have a similar way to manage Python projects. So you declare your dependencies, and then we create a lock file for you. We have the uv run interface that will automatically resolve your dependencies, create a virtual environment, populate it, and then run the command in the virtual environment. So if you use that, you don't have to think about all those manual, what used to be manual commands of like create the environment, resolve the dependencies, install them into the environment, activate it. So it's an attempt to introduce these kind of higher level workflows that if you follow them, right, they require some changes in your behavior. But if you follow them, they can take a lot of the complexity out of it.
In the latest release, uv can now install and manage your Python installation for you, which makes it much faster to get up and running on a project.
“It means that you can install UV and start running stuff, and it will just install Python for you if you don't have it already,” Marsh said. “So you don't need to have Python installed on your system necessarily to get started and work with UV.
“Also, if you need to test on a bunch of different versions, we can install all those versions for you. It all just happens as you use UV. And then we also added a bunch of APIs around working with Python outside of the context of projects.”
Astral has completely reimagined how people build with Python with uv’s latest release. They are currently a team of eight people, and everything they build is open source, heavily inspired by Cargo and the Rust ecosystem.
“We work in rust, we build all our stuff and all our tools in rust, and rust has really, really good tooling,” Marsh said. “And Rust is in a very different position from Python, because in Python, everything evolved over a long period of time very organically. We didn't have as much experience as a programming community at building and designing these kinds of systems.
“With Rust, it's a much newer language and ecosystem, and they had the opportunity to really consider, ‘What do we want the tooling experience to be?’ and to take lessons from other ecosystems and other communities. And so Rust has this sort of non-first mover advantage of learning from lots of other ecosystems.”
Marsh explained how the Astral team has tried to take some lessons and things they like about Cargo and translate them to Python. They don’t always translate, but they have taken a great deal of inspiration from Rust, as well as existing tools in the Python ecosystem like PipX that people enjoy using.
“We wanted to create something that was really easy for people to use, that people could adopt with minimal friction, in part because it meant we invested a lot of time in building a really good package resolver and package installer,” he said.
After releasing uv in February as a basic pip alternative, they started getting more adoption, more testing, and consequently, a lot more bugs. Astral continued to improve it over the past few months with features to make Python developers more productive.
“From our perspective, pip is kind of a low-level tool,” Marsh said. “If you think about the way that you use pip, it's like you have an environment and then you ask pip to install a package into that environment or remove a package from that environment.
“In a lot of other ecosystems and in some other Python tools, you get to work at a slightly higher level. So typically, you're saying things like, ‘These are the dependencies for my project. Just make sure that they're all installed at the right versions and that the environment is all set up for me to work in’. And you don't have to think about, where's my virtual environment? Is it up to date? I just uninstalled something. Did it uninstall everything or did it just uninstall the thing? Just keeping everything in sync.
“So our goal was always to build something that was higher level and that we hoped would solve more of the problems that people have with Python packaging.”
The latest release represents the Astral team’s attempt to take uv beyond being just a pip alternative and into a higher level tool that reduces friction in Python development. There’s an undeniable buzz around uv’s potential to streamline workflows and replace older tools. So far the community reception has been enthusiastic with early predictions of uv rapidly gaining broad adoption.
Subscribe to our newsletter
Get notified when we publish new security blog posts!
Try it now
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.