Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
bconstanzo: this is a fork of K0lb3's work focused on improving performance by adding some Cython magic (types, which took a bit of effort to get right). Since it completely removes python from the hot loop (and almost all of the decompression function) it achieves some nice speedups (6-8 times faster). Any bottlenecks would then be inside the C++ functions, or your compilers ability to optimize said code.
The main reason I'm making this fork is that iLEAPP had the astc_decomp module as a bottleneck at the time of release, and I worked a couple of weeks into improving it. There may be better alternatives for ASTC decompression out there.
K0lb3's original readme follows:
An ASTC decoder for PIL.
The decoder uses richgel999/astc_dec to decompress the ASTC blocks.
pip install astc_decomp
python setup.py install
from PIL import Image
import astc_decomp
#needs to be imported once in the active code, so that the codec can register itself
astc_data : bytes
block_width : int
block_height : int
is_srgb : bool = False
img = Image.frombytes('RGBA', size, astc_data, 'astc', (block_width, block_height, is_srgb))
from astc_decomp import decompress_astc
# ASTC to RGBA
rgba_data = decompress_astc(astc_data : bytes, width : int, height : int, block_width : int, block_height : int, is_srgb : bool = False)
FAQs
ASTC decoder for PIL (just faster)
We found that astc-decomp-faster demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.