Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
It is an asynchronous wrapper around libcurl which is built to interface with the Uvloop python library.
The gateway into Acurl is through the CurlWrapper (discussed in Architectural Notes) and requires an event loop being passed to its constructor. Below is the mite implementation of acurl:
class SessionPool:
...
def __init__(self):
import acurl
self._wrapper = acurl.CurlWrapper(asyncio.get_event_loop())
...
Acurl uses a single loop maintained within python using UVloop.
Acurl surfaces the CurlWrapper interface which takes the asyncio event loop as an argument. The wrapper deals directly with the curl_multi interface from libcurl, defining 2 functions (curl_perform_write
and curl_perform_read
) for checking both read and write availability of file descriptors.
There are 2 notable functions within the core Acurl implementation, notably handle_socket
and start_timer
:
handle_socket
is passed as a callback function to the curl_multi interface and upon calls to the curl_multi_socket_action
function, will receive updates regarding the socket status. We then handle those statuses by either adding or removing the aforementioned readers or writers.start_timer
is another callback function that is passed to the curl_multi interface and is used as a way to handle timeouts and retries within curl. Upon a timeout, the timeout callback will be called and the transfer can be retried.FAQs
An async Curl library.
We found that acurl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.