
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
mirror-github.paniser.workers.dev/achannarasappa/ticker
Advanced tools
Terminal stock watcher and stock position tracker
Download the pre-compiled binaries from the releases page and copy to a location in PATH or see quick installs below
mac
brew install achannarasappa/tap/ticker
linux
curl -Ls https://api.github.com/repos/achannarasappa/ticker/releases/latest \
| grep -wo "https.*linux-amd64*.tar.gz" \
| wget -qi - \
&& tar -xf ticker*.tar.gz \
&& chmod +x ./ticker \
&& sudo mv ticker /usr/local/bin/
ticker -w NET,AAPL,TSLA
| Alias | Flag | Default | Description |
|---|---|---|---|
| --config | ~/.ticker.yaml | config with watchlist and positions | |
| -i | --interval | 5 | Refresh interval in seconds |
| -w | --watchlist | comma separated list of symbols to watch | |
| --extra-info-exchange | display currency, exchange name, and quote delay for each quote | ||
| --extra-info-fundamentals | display open price, previous close, and day range | ||
| --separate | layout with separators between each quote |
Configuration is not required to watch stock price but is helpful when always watching the same stocks. Configuration can also be used to set cost basis lots which will in turn be used to show daily gain or loss on any position.
# ~/.ticker.yaml
watchlist:
- NET
- TEAM
- ESTC
- BTC-USD
lots:
- symbol: "ABNB"
quantity: 35.0
unit_cost: 146.00
- symbol: "ARKW"
quantity: 20.0
unit_cost: 152.25
- symbol: "ARKW"
quantity: 20.0
unit_cost: 145.35
lots will automatically be watchedwatchlist and lots are both optional propertiesWith --extra-info-exchange, --extra-info-fundamentals, and --separate options set, the layout and information displayed expands:
--extra-info-exchange flag to include timeliness of data alongside quotes in ticker.FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.