Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
An extension to the built-in ast
module.
Finds comments in source code and adds them to the parsed tree.
pip install ast-comments
There is no difference in usage between ast
and ast-comments
>>> from ast_comments import *
>>> tree = parse("hello = 'hello' # comment to hello")
Parsed tree is an instance of the original ast.Module
object.
The only difference is that there is a new type of tree node: Comment
>>> tree
<_ast.Module object at 0x7ffba52322e0>
>>> tree.body
[<ast.Assign object at 0x10a01d5b0>, <ast_comments.Comment object at 0x10a09e0a0>]
>>> tree.body[1].value
'# comment to hello'
>>> dump(tree)
"Module(body=[Assign(targets=[Name(id='hello', ctx=Store())], value=Constant(value='hello')), Comment(value='# comment to hello', inline=True)], type_ignores=[])"
If you have python3.9 or above it's also possible to unparse the tree object with its comments preserved.
>>> print(unparse(tree))
hello = 'hello' # comment to hello
Note: Python compile()
cannot be run on the tree output from parse. The included pre_compile_fixer()
function can be used to fix the tree (stripping
comment nodes) if it will be necessary to compile the output.
More examples can be found in test_parse.py and test_unparse.py.
You are welcome to open an issue or create a pull request
FAQs
Unknown package
We found that ast-comments demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.