Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The A2ML ("Automate AutoML") project is a Python API and set of command line tools to automate Automated Machine Learning tools from multiple vendors. The intention is to provide a common API for all Cloud-oriented AutoML vendors. Data scientists can then train their datasets against multiple AutoML models to get the best possible predictive model. May the best "algorithm/hyperparameter search" win. Full documentation for A2ML is available at a2ml.org
Every AutoML vendor has their own API to manage the datasets and create and manage predictive models. They are similar but not identical APIs. But they share a common set of stages:
Since ITEDPR is hard to remember we refer to this pipeline by its conveniently mnemonic anagram: "PREDIT" (French for "predict"). The A2ML project provides classes which implement this pipeline for various Cloud AutoML providers and a command line interface that invokes stages of the pipeline.
A2ML is distributed as a python package, so to install it:
$ pip install -U a2ml
It will install Auger provider.
To use Azure AutoML:
$ brew install libomp
$ SKLEARN_NO_OPENMP=1 pip install "scikit-learn==0.21.3"
$ pip install "a2ml[azure]" --ignore-installed onnxruntime onnx nimbusml
$ apt-get update && apt-get -y install gcc g++ libgomp1
$ pip install "a2ml[azure]"
To use Google Cloud:
$ pip install "a2ml[google]"
To install everything including testing and server code:
$ pip install "a2ml[all]"
To release a new version the flow should be:
Change the __version__
variable in a2ml/__init__.py
to match what you want to release, minus the "v". By default it would be ".dev0", for example "0.3.0.dev0". This ensures we don’t accidentally release a dev version to pypi.org. So for when we’re ready to release 0.3.0, the __version__
variable should simply be "0.3.0".
Commit and push the changes above.
git tag v<the-version> (for example: git tag v0.3.0)
git push --tags
pip install -U a2ml==0.3.0
docker pull augerai/a2ml:v0.3.0
__version__
variable in a2ml/__init__.py
to the next version in the current milestone. For example, "0.3.1.dev0"FAQs
A powerful API to Automate Machine Learning workflows from multiple vendors.
We found that a2ml demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.