
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
github.com/teris-io/cli
Module cli
provides a simple, fast and complete API for building command line applications in Go.
In contrast to other libraries the emphasis is put on the definition and validation of
positional arguments, handling of options from all levels in a single block as well as
a minimalistic set of dependencies.
The core of the module is the command, option and argument parsing logic. After a successful parsing the command action is evaluated passing a slice of (validated) positional arguments and a map of (validated) options. No more no less.
co := cli.NewCommand("checkout", "checkout a branch or revision").
WithShortcut("co").
WithArg(cli.NewArg("revision", "branch or revision to checkout")).
WithOption(cli.NewOption("branch", "Create branch if missing").WithChar('b').WithType(cli.TypeBool)).
WithOption(cli.NewOption("upstream", "Set upstream for the branch").WithChar('u').WithType(cli.TypeBool)).
WithAction(func(args []string, options map[string]string) int {
// do something
return 0
})
add := cli.NewCommand("add", "add a remote").
WithArg(cli.NewArg("remote", "remote to add")).
rmt := cli.NewCommand("remote", "Work with git remotes").
WithCommand(add)
app := cli.New("git tool").
WithOption(cli.NewOption("verbose", "Verbose execution").WithChar('v').WithType(cli.TypeBool)).
WithCommand(co).
WithCommand(rmt)
// no action attached, just print usage when executed
os.Exit(app.Run(os.Args, os.Stdout))
Given the above definition is for a git client, e.g. gitc
, running gitc
with no arguments or with -h
will
produce (the exit code will be 1 in the former case, because the action is missing, and 0 in the latter, because
help explicitly requested):
gitc [--verbose]
Description:
git tool
Options:
-v, --verbose Verbose execution
Sub-commands:
git checkout checkout a branch or revision
git remote Work with git remotes
Running gitc
with arguments matching e.g. the checkout
definition, gitc co -vbu dev
or
gitc checkout -v --branch -u dev
will execute the command as expected. Running into a parsing error, e.g.
by providing an unknown option gitc co -f dev
, will output a parsing error and a short usage string:
fatal: unknown flag -f
usage: gitc checkout [--verbose] [--branch] [--upstream] <revision>
Copyright (c) 2017. Oleg Sklyar and teris.io. MIT license applies. All rights reserved.
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.