
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
acdumo
Advanced tools
This app is a simple implementation of the Accelerated Dual Momentum investment strategy. It queries a Yahoo Finance API for historical ticker price data, calculates ADM statistics, and suggests a strategy.
For simple command line use of this app, you can install with pip:
pip3 install acdumo
or
pip3 install --user acdumo
Installation will require an extra step on macOS systems. Run the included acdumo-install-certifi command.
acdumo-install-certifi
To generate a report for the current date, simply run:
acdumo
Optional arguments can be used to generate reports for different dates or tickers:
acdumo --help
usage: acdumo [-h] [--date <yyyy-mm-dd>] [--tickers <TIC> [<TIC> ...]] [--bonds <TIC>] [--frequency {monthly,weekly}] [<path/to/report/dir/>]
Accelerated dual momentum
positional arguments:
<path/to/report/dir/>
write a HTML report
optional arguments:
-h, --help show this help message and exit
--date <yyyy-mm-dd> date of interest (default: today)
--tickers <TIC> [<TIC> ...]
tickers to use (default: SPY TLT VSS SCZ)
--bonds <TIC> ticker representing bonds (default: TLT)
--frequency {monthly,weekly}
frequency of data to fetch (default: monthly)
To run the app locally, use the following procedure. By default it is configured to use a gmail account of your choice for account confirmation emails. The gmail account must be configured to allow less secure apps.
git clone https://github.com/anthony-aylward/acdumo.git
cd acdumo
python3 -m venv venv
source venv/bin/activate
pip3 install -e . # if on macOS, also run: python3 acdumo/install_certifi.py
export FLASK_APP=acdumo
export FLASK_ENV=development
mkdir -p instance/protected
python3 config/__init__.py --email <gmail address> instance/
flask db upgrade
flask run
You can then use a web browser to navigate to the app (by default at localhost:5000)
FAQs
Accelerated dual momentum
We found that acdumo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.