
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Contents:
Release Notes:
1.0.21
Added S3 support
Added "owc.aws.invoke" method to invoke any methods in aws-sdk
1.0.19
Added DynamoDB support
Added atomic operations for redis
Added unit test scripts for redis and dynamodb
1. Installation
Please install owc-cli to generate project, modules, models, etc. Please refer to this link:
https://www.npmjs.com/package/owc-cli
2. File structure
3. Model
Once you generate a model for a table, you are able to query against database like below:
let users = await User.find().where({id : 10, status : 1}).all();
let user = await User.findByPk(10);
let user = await User.find().where({id:10}).one();
let ret = await user.save();
4. Database
owc supports mysql and mysql compatible aurora database. It also allows you to set up master and slaves database.
You can run raw sql by passing sql commands and bind parameters into below functions:
owc.db.query(sql, bind, transaction = null)
owc.db.queryAll(sql, bind, transaction = null)
5. Cache
owc supports memcached and redis. Redis also supports master and slaves mode.
6. ElasticSearch
owc can create elasticsearch model for each table in mysql database. You can query elasticsearch like a database.
For example, you can search like below:
let users = await User.find().where({id : 10, status : 1}).all();
6. AWS
OWC added built in libraries for some AWS services:
7. Log
owc supports winston and console log
FAQs
a lightweight web service framework for aws lambda
The npm package owc receives a total of 3 weekly downloads. As such, owc popularity was classified as not popular.
We found that owc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.