
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
github.com/codemodify/systemkit-service-spec
After reading a ton of material on
init
frameworks and service management for different OSes; Going through mental debate of smartness of one versus another and their historical backlog and tech debt, as well as developer and user friendliness of the material provided which in itself can drive away companies and engineering force to provide support for one or another platform - THE TAKE AWAY IS - In the end what matters is to have an OS efficient and developer friendly mechanics to manipulate a service.
This repo proposes to create a portable
SERVICE
definition that can be used by developers and businesses to implement their products on a range of platforms without worrying about misunderstanding the genius on each of those.
- Use Case (A) - code
NewServiceFromSERVICE()
- creates and controls a service based on
SERVICE
portable descriptionNewServiceFromName()
- finds and controls an existing service based on its name; previously created by our app or something else
NewServiceFromPlatformTemplate()
- create a service from a platform dependent template
- template is already a service definition as it is defined by the one of
init
frameworks
- Use Case (B) - scripting
- manipulate a service based on a SERVICE file
systemkit-service-spec-cli create/delete/start/stop/info -service SERVICE-FILE
- manipulate a service based on commands and flags
systemkit-service-spec-cli create/delete/start/stop/info -name test-service -executable vim
- compile your own service manipulator binary based on the
systemkit-service-spec-cli
source code
- Use Case (C) - convert
- used as an ETL mechanism, used by scripting or cloud based services
- convert
SERVICE
file to a platform dependent format- convert platform dependent format to
SERVICE
format- convert platform dependent format to a different platform dependent format, by going through
SERVICE
format
{
"name": "test-service",
"description": "Test Service",
"documentation": "http://test-service.com",
"executable": "/bin/sleep",
"args": [
"40"
],
"workingDirectory": "/tmp",
"environment": {
"API_URL": "https://api.test-service.com"
},
"dependsOn": [
"network"
],
"dependsOnOverrides": {
"init_rc.d": {
"remove": [
"*"
],
"add": [
"bumblebee",
"mumbled"
]
},
"init_systemd": {
"add": [
"printer"
]
},
"os_freebsd": {
"add": [
"linux"
]
},
"os_linux": {
"add": [
"bluetooth"
]
}
},
"start": {
"atBoot": true,
"restart": true,
"restartTimeout": 10
},
"logging": {
"stdout": {
"disabled": false,
"useDefault": false,
"value": "/var/log/test-service-stdout.log"
},
"stderr": {
"disabled": false,
"useDefault": false,
"value": "/var/log/test-service-stderr.log"
}
},
"credentials": {
"user": "user",
"group": "group"
}
}
Any missing credits are the author's unconscious error
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.