Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Contains a simple client for calling the v2 endpoints of the ACRCloud API.
poetry add acrclient
# or on old setup style projects
pip -m install acrclient
>>> from acrclient import Client
>>> client = Client(bearer_token="bearer-token")
# setup a dev env
python -mvenv env
. env/bin/activate
# install a modern poetry version
python -mpip install poetry>=1.2.0
# install deps and dev version
poetry install
# make changes, run tests
poetry run pytest
The CI/CD setup uses semantic commit messages following the conventional commits standard. There is a GitHub Action in .github/workflows/semantic-release.yaml that uses go-semantic-commit to create new releases.
The commit message should be structured as follows:
<type>[optional scope]: <description>
[optional body]
[optional footer(s)]
The commit contains the following structural elements, to communicate intent to the consumers of your library:
fix
patches gets released with a PATCH version bumpfeat
gets released as a MINOR version bumpBREAKING CHANGE:
gets released as a MAJOR version bumpfix:
and feat:
are allowed and don't trigger a releaseIf a commit does not contain a conventional commit style message you can fix it during the squash and merge operation on the PR.
Once a commit has landed on the main
branch a release will be created and automatically published to pypi
using the GitHub Action in .github/workflows/release.yaml which uses poetry
to publish the package to pypi.
This package is free software: you can redistribute it and/or modify it under the terms of the GNU Affero General Public License as published by the Free Software Foundation, version 3 of the License.
Copyright (c) 2023 Radio Bern RaBe
FAQs
API wrapper for the v2 ACRCloud API
We found that acrclient demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.