Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Aliot-py is the python implementation of the Aliot library, an IOT library made to work with the ALIVEIoT ecosystem (see https://alivecode.ca/iot)
Before everything else, aliot is a fancy websocket written in python that aims to facilitate iot focused exchanges between a server and a client
py -m venv venv
pip install ./$FOLDER
Create a function that takes some parameters
# my function will take money ($) and give cookies for every 2$ received
def give_cookies_for_money(money: int):
return {"cookies": money // 2}
Register your function as a protocol by decorating it with the on_recv
decorator in your ObjConnecte that you
created for your project and pass the id of your protocol in the argument of the decorator
# here, I chose that my function will be protocol 34
@my_iot.on_recv(action_id=34)
def give_cookies_for_money(money: int):
return {"cookies": money // 2}
As of now, my function give_cookies_for_money
doesn't return anything to the server, if I want to send back my
cookies, I have to ways:
my_iot.send()
@my_iot.on_recv(action_id=34)
def give_cookies_for_money(money: int):
my_iot.send({"cookies": money // 2})
send_result
to True in the decorator@my_iot.on_recv(action_id=34, send_result=True)
def give_cookies_for_money(money: int):
return {"cookies": money // 2}
run()
is called)FAQs
Aliot-py is the python implementation of the Aliot library, an IOT library made to work with the ALIVEIoT ecosystem (see https://alivecode.ca/iot)
We found that aliot-py demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.