
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
The nightly-only concat_idents! macro in the Rust standard library is
notoriously underpowered in that its concatenated identifiers can only refer to
existing items, they can never be used to define something new.
This crate provides a flexible way to paste together identifiers in a macro, including using pasted identifiers to define new items.
[dependencies]
paste = "0.1"
This approach works with any stable or nightly Rust compiler 1.30+.
There are two entry points, paste::expr! for macros in expression position and
paste::item! for macros in item position.
Within either one, identifiers inside [<...>] are pasted together to form a
single identifier.
// Macro in item position: at module scope or inside of an impl block.
paste::item! {
// Defines a const called `QRST`.
const [<Q R S T>]: &str = "success!";
}
fn main() {
// Macro in expression position: inside a function body.
assert_eq!(
paste::expr! { [<Q R S T>].len() },
8,
);
}
This program demonstrates how you may want to bundle a paste invocation inside
of a more convenient user-facing macro of your own. Here the routes!(A, B)
macro expands to a vector containing ROUTE_A and ROUTE_B.
const ROUTE_A: &str = "/a";
const ROUTE_B: &str = "/b";
macro_rules! routes {
($($route:ident),*) => {{
paste::expr! {
vec![$( [<ROUTE_ $route>] ),*]
}
}}
}
fn main() {
let routes = routes!(A, B);
assert_eq!(routes, vec!["/a", "/b"]);
}
The next example shows a macro that generates accessor methods for some struct fields.
macro_rules! make_a_struct_and_getters {
($name:ident { $($field:ident),* }) => {
// Define a struct. This expands to:
//
// pub struct S {
// a: String,
// b: String,
// c: String,
// }
pub struct $name {
$(
$field: String,
)*
}
// Build an impl block with getters. This expands to:
//
// impl S {
// pub fn get_a(&self) -> &str { &self.a }
// pub fn get_b(&self) -> &str { &self.b }
// pub fn get_c(&self) -> &str { &self.c }
// }
paste::item! {
impl $name {
$(
pub fn [<get_ $field>](&self) -> &str {
&self.$field
}
)*
}
}
}
}
make_a_struct_and_getters!(S { a, b, c });
fn call_some_getters(s: &S) -> bool {
s.get_a() == s.get_b() && s.get_c().is_empty()
}
Use $var:lower or $var:upper in the segment list to convert an interpolated
segment to lower- or uppercase as part of the paste. For example, [<ld_ $reg:lower _expr>] would paste to ld_bc_expr if invoked with $reg=Bc.
Use $var:snake to convert CamelCase input to snake_case.
Use $var:camel to convert snake_case to CamelCase.
These compose, so for example $var:snake:upper would give you SCREAMING_CASE.
The precise Unicode conversions are as defined by str::to_lowercase and
str::to_uppercase.
FAQs
Unknown package
We found that paste demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.