Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
pip install args_to_db
args_to_db is an attempt to generalize and simplify the process of running a programm in different modes or configurations and combining the resulting datasets to allow for further analysis.
The functionality is separated into three different (independently usable) parts:
Given a programm/script which is highly dependent on parameters and arguments, which we want to run for swarm of different settings, yielding datasets for further analysis.
Argument construction is made easy with the interfaces cmd, option, flag
which are the intended way of constructing Command
and CommandList
objects.
from args_to_db import cmd, flag, option
py = cmd('python')
# > py=[['python']]
script = cmd('script.py')
# > py=[['script.py']]
data = option('--input', ['file1.csv', 'file2.csv'])
# > data=[['--input', 'file1.csv'],
# ['--input', 'file2.csv']]
opt_flags = flag('-O') + flag('-r')
# > opt_flags=[[],
# ['-r'],
# ['-O'],
# ['-O', '-r']]
log_flag = flag('--log', vary=False)
# > log_flag=[['--log']]
cmds = py + script + data + opt_flags + log_flag
# > cmds=[['python', 'script.py', '--input', 'file1.csv', '--log'],
# ['python', 'script.py', '--input', 'file1.csv', '-r', '--log'],
# ['python', 'script.py', '--input', 'file1.csv', '-O', '--log'],
# ['python', 'script.py', '--input', 'file1.csv', '-O', '-r', '--log'],
# ['python', 'script.py', '--input', 'file2.csv', '--log'],
# ['python', 'script.py', '--input', 'file2.csv', '-r', '--log'],
# ['python', 'script.py', '--input', 'file2.csv', '-O', '--log'],
# ['python', 'script.py', '--input', 'file2.csv', '-O', '-r', '--log']]
The CommandList
objects are arrays of commands (which themselves are arrays again), they behave like normal python arrays except for the differnt usage of the +
and +=
operators.
A given CommandList
object may then be executed with run
, providing the user with a live interface in the terminal of execution states and parallelisation control of the execution.
run(cmds, threads=4)
# runs all specified commands with up to 4 concurrent threads.
Data may be produced by the programm/script independently of being called with args_to_db, which is therefore completely optional. But functionality is provided to make data collection and combination straight forward and as easy as possible for fast results.
args = argparse.ArgumentParser().parse_args()
config = config_from_args(args, __file__)
write_results(config, {'solver_solve_time': solve_time})
This produces an output which is then later on combined with the others by the run
task - note the native support of argparse
objects which are often used for argument/parameter parsing.
FAQs
Runs python script in argument combinations and produces dataset of all results.
We found that args-to-db demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.