Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@atom/dowsing-rod
Advanced tools
Dowse for Python 2.7 installations on your system and make them available to node-gyp
subprocesses.
node-gyp
only works with Python 2, and this is unlikely to change in the near future.
Furthermore, while node-gyp
allows you to override the Python executable it discovers itself by specifying a PYTHON
environment variable or setting the python
npm config option, certain node-gyp
builds will only work correctly if the python 2 executable is on the ${PATH}
with the exact name "python", because the Makefiles they generate execute generated files with a shebang line of #!/usr/bin/env python
.
Fixing this upstream would be tricky and require changes to trickle through a number of dependent projects. Hence @atom/dowsing-rod, which exists to:
$PYTHON
variable (b) as any python
, python2
, or python2.7
executable on your $PATH
or (c) specified directly as a .python2-bin
file.$PYTHON
environment variable to the discovered binary's path. Prepend a directory containing a wrapper script to your $PATH
so that shebang scripts will execute your chosen Python binary properly.$ npm install @atom/dowsing-rod
You'll also likely want to add .python2-bin
to your .gitignore
:
$ echo '.python2-bin' >> .gitignore
To fix your node-gyp rebuild
command, add the following to your package.json
:
{
"scripts": {
"install": "with-python2-env node-gyp rebuild"
}
}
If you're launching node-gyp as a subprocess yourself (like we do within the :atom: build scripts, for example), you can modify your process' environment directly:
const path = require('path')
const dowsingRod = require('@atom/dowsing-rod')
const options = {
// npm binary used to read config settings
npmBin: 'npm',
// file to store located Python binary
pythonBinFile: path.join(process.cwd(), '.python2-bin')
}
// Options are optional with the defaults shown.
const promise = dowsingRod.setPythonEnv(options, process.env)
// Any exec or spawn calls after the returned promise resolves will have the correct Python environments.
// Or, if you wish to do something with the path yourself:
dowsingRod.getPythonBin(options)
.then(pythonBin => console.log(`Python binary: ${pythonBin}`))
// Synchronous variants are also exported:
dowsingRod.setPythonEnvSync(options, process.env)
const pythonBin = dowsingRod.getPythonBinSync(options)
FAQs
Dowse for compatible Python 2 installations to run node-gyp
The npm package @atom/dowsing-rod receives a total of 2 weekly downloads. As such, @atom/dowsing-rod popularity was classified as not popular.
We found that @atom/dowsing-rod demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 15 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.