
Research
TeamPCP Compromises Telnyx Python SDK to Deliver Credential-Stealing Malware
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.
the-moby-effect
Advanced tools
Moby API client and CLI client built using effect-ts. If you want documentation, please consider reading The Docker API documentation, it is very well written and there is nothing in this library that wouldn't be in there (plus I would just do a worse job if I tried to write my interpretation of their documentation here). If you are just looking for some examples to get your feet underneath you quickly with effect integration, then I do have some of those here.
The motivation for this project come from working with dockerode and I became frustrated with the incorrect types sometimes and the error handling - I did not want to wrap every docker call in a try/catch. Those are the two main reasons why I built the-moby-effect with effect-ts. I also wanted to see if I could build a moby api client that could be used in a web/frontend environment.
DOCKER_HOST environment variable supportVersion negotiating: either install a specific version for the moby api that you are targeting or just keep your docker install somewhat up-to-date and you should have no problems
Promise/callback api: this project is built on-top of effect-ts and uses it quite extensively. While it would be simple to wrap all the apis in Effect.runPromise calls, I don't want to do that because you lose the error management, scheduling, concurrency that effect makes so elegant. If you don't want to adopt effect-ts into your entire stack/project, don't fear, you can either wrap everything in a Effect.runPromise call yourself or use an effect ManagedRuntime where you are using the-moby-effect.
DockerCompose support. Blocked only because I have no idea where to even start on this. I'm confident it just reuses the moby api's so there are no new api's, but that means I have to rewrite the docker-compose go plugin in TS which I'm not too thrilled about. Unlike this rest of this project, it's not something that I directly need, which is why I am not too interested in supporting this.
Basic docker compose support has been implemented, more to come in the future.
the-moby-effect targets the current stable version of the moby api, which is v1.43 at the time of writing. If you are curious what that translates to for docker versions then take a look at this api version matrix published by Docker. As stated in the api version matrix, only Docker v24.0 would be officially supported by the-moby-effect, however, we still test against docker v20, v23, v24, and the next release candidate which is v25 (there is no v21 or v22 btw). Here is another note from Docker:
"The Docker daemon and client don't necessarily need to be the same version at all times. However, keep the following in mind":
The only compatibility issue found so far is that when using the-moby-effect with docker v20 you can not filter or prune volumes using the all filter as it was not present at the time. Other than that all functionality appears to still work.
If you want to use the-moby-effect in a web environment or with the undici agent layer, you can not use the containerAttach or the execStart (with Detach false) endpoints as both will attempt to reuse the tcp socket from the http request which will not be available in those layers. To use those endpoints, you must be using the Node/Bun/Deno agent layer. Alternatively, if you need to attach to containers in a web environment, you could use the containerAttachWs endpoint to achieve similar features over a websocket instead.
This package does not follow semantic versioning, instead the major and minor part represents the version of the moby api. All bugfixes, breaking or otherwise, will be released under an incremented patch version.
https://leoconforti.pages.ltgk.net/the-moby-effect/
Contributions, suggestions, and questions are welcome! If you are interested in developing, my recommendation is going to be to use the Devcontainer (even if you don't like them) as it has everything setup already to run the tests or to just let Github actions run the tests. I'll review prs and respond to issues/discussion here on GitHub but if you want more synchronous communication you can find me in the effect discord as @leonitous
If the GNU General Public License v3.0 does not work for you, please reach out and let me know, I can be accommodating
FAQs
Moby/Docker API client built using effect-ts
The npm package the-moby-effect receives a total of 23 weekly downloads. As such, the-moby-effect popularity was classified as not popular.
We found that the-moby-effect demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.

Security News
/Research
Widespread GitHub phishing campaign uses fake Visual Studio Code security alerts in Discussions to trick developers into visiting malicious website.