Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package is devloped and maintained by Astar Vienna and contains commonly-used utilities for the group's projects to avoid both duplicating code and circular dependencies.
The package currently contains the following public functions and classes:
NestedMapping
: a dict
-like structure supporting !-style nested keys.RecursiveNestedMapping
: a subclass of NestedMapping
also supporting keys that reference other !-style keys.NestedChainMap
: a subclass of collections.ChainMap
supporting instances of RecursiveNestedMapping
as levels and referencing !-style keys across chain map levels.is_bangkey()
: simple convenience function to check if something is a !-style key.is_nested_mapping()
: convenience function to check if something is a mapping containing a least one other mapping as a value.UniqueList
: a list
-like structure with no duplicate elements and some convenient methods.Badge
and subclasses: a family of custom markdown report badges. See docstring for details.BadgeReport
: context manager for collection and generation of report badges. See docstring for details and usage.get_logger()
: convenience function to get (or create) a logger with given name
as a child of the universal astar
logger.get_astar_logger()
: convenience function to get (or create) a logger with the name astar
, which serves as the root for all A*V packages and applications.SpectralType
: a class to parse, store and compare spectral type designations.loggers.ColoredFormatter
: a subclass of logging.Formatter
to produce colored logging messages for console output.Dependencies are intentionally kept to a minimum for simplicity. Current dependencies are:
more-itertools
pyyaml
Version requirement for these dependencies can be found in the pyproject.toml
file.
FAQs
Contains commonly-used utilities for AstarVienna's projects.
We found that astar-utils demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.