
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
github.com/ericflo/gradientzoo
Gradientzoo is an open source website and API service for versioning and sharing neural network model weights. This repo is essentially a monorepo, filled with everything needed to run your own version of the site and service:
Supports saving models in Keras, variables in Tensorflow, and networks in Lasagne, and regular old files using Python with your framework of choice.
There are a number of files with secrets in them, which cannot be checked into this repo. Instead, we've provided template files for you to remove the .template extension from and fill in the blanks:
To start the development server, enter the following command:
source bin/env && go run main.go
If that doesn't work, you need to set up your development configuration starting from the provided template:
cp bin/env.template bin/env
Make sure to fill in the blanks in the file bin/env
. (Mainly this means
entering your AWS credentials.)
If you want to connect to a remote postgres instead of running a local one after you've deployed, run this command to forward the port:
./bin/forward-ports
If you are having issues, please let us know at support@gradientzoo.com
Before you get started, you'll need these things set up:
Here's what we're going to do:
To provision the disk for use by the database, run the following command:
gcloud compute disks create gradientzoo-postgres-disk --size 250GB
Now let's make builds for both the API and the web frontend, and push the Docker images:
./bin/rebuild-api
./bin/rebuild-web
Next, we send Kubernetes everything it needs to spin up the entire cluster:
kubectl create -f deploy/
Here are the commands you'll need to open up the firewall:
export WWW_NODE_PORT=$(kubectl get -o jsonpath="{.spec.ports[0].nodePort}" services gradientzoo-web-svc)
export API_NODE_PORT=$(kubectl get -o jsonpath="{.spec.ports[0].nodePort}" services gradientzoo-api-svc)
export TAG=$(kubectl get nodes | awk '{print $1}' | tail -n +2 | grep -wo 'gke.*-node' | uniq)
gcloud compute firewall-rules create allow-130-211-0-0-22 \
--source-ranges 130.211.0.0/22 \
--target-tags $TAG \
--allow tcp:$WWW_NODE_PORT,tcp:$API_NODE_PORT
Finally, you'll want to point your DNS entries to your new cluster, and then you're set!
TODO
* Proper 404 page
* Show one or two extra params in list
* Import common public domain datasets for popular libraries into a 'commons'
* Allow user to edit the name and description of their model
* Links from homepage to full model lists
* Infinite pagination on the full model lists
* Make the webapp universal
* Badge for projects on GitHub
* Log in with GitHub
* [ops] Switch to Google Cloud Storage rather than AWS for blob storage
* [ops] Set up an ElasticSearch, Logstash/Heka, Kibana (E[LH]K) stack
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.