Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
.. image:: https://github.com/lmfit/asteval/actions/workflows/ubuntu_numpy.yml/badge.svg :target: https://github.com/lmfit/asteval/actions/workflows/ubuntu_numpy.yml
.. image:: https://github.com/lmfit/asteval/actions/workflows/ubuntu_nonumpy.yml/badge.svg :target: https://github.com/lmfit/asteval/actions/workflows/ubuntu_nonumpy.yml
.. image:: https://github.com/lmfit/asteval/actions/workflows/macos_numpy.yml/badge.svg :target: https://github.com/lmfit/asteval/actions/workflows/macos_numpy.yml
.. image:: https://github.com/lmfit/asteval/actions/workflows/windows_numpy.yml/badge.svg :target: https://github.com/lmfit/asteval/actions/workflows/windows_numpy.yml
.. image:: https://codecov.io/gh/lmfit/asteval/branch/master/graph/badge.svg :target: https://codecov.io/gh/lmfit/asteval
.. image:: https://img.shields.io/pypi/v/asteval.svg :target: https://pypi.org/project/asteval
.. image:: https://img.shields.io/pypi/dm/asteval.svg :target: https://pypi.org/project/asteval
.. image:: https://img.shields.io/badge/docs-read-brightgreen :target: https://lmfit.github.io/asteval/
.. image:: https://zenodo.org/badge/4185/newville/asteval.svg :target: https://zenodo.org/badge/latestdoi/4185/newville/asteval
Use pip install asteval
to install the asteval library.
Asteval requires Python 3.8 or higher. If installed, many functions and constants from Numpy will be used by default.
ASTEVAL is a safe(ish) evaluator of Python expressions and statements,
using Python's ast module. The idea is to provide a simple, safe, and
robust miniature mathematical language that can handle user input. The
emphasis here is on mathematical expressions so that many functions from
numpy
are imported and used if available.
Many Python language constructs are supported by default, These include slicing, subscripting, list comprehension, conditionals (if-elif-else blocks and if expressions), flow control (for loops, while loops, and try-except-finally blocks). All data are Python objects and built-in data structures (dictionaries, tuples, lists, Numpy arrays, strings) are fully supported by default.
Many of the standard built-in Python functions are available, as are all mathematical functions from the math module. If the Numpy module is installed, many of its functions will also be available. Users can define and run their own functions within the confines of the limitations of Asteval.
There are several absences and differences with Python, and Asteval is by no means an attempt to reproduce Python with its own ast module. Some of the most important differences and absences are:
In addition, accessing many internal methods and classes of objects is forbidden in order to strengthen Asteval against malicious user code.
Matt Newville newville@cars.uchicago.edu Last Update: 30-June-2024
FAQs
Safe, minimalistic evaluator of python expression using ast module
We found that asteval demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.