Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Documentation: https://engine.avwx.rest
Source Code: https://github.com/avwx-rest/avwx-engine
PyPI: https://pypi.org/project/avwx-engine/
AVWX is a global aviation weather fetching and parsing engine. It sources reports from a variety of government sources, parses individual elements, and calculates additional information like flight rules and time range interpolation.
AVWX currently supports:
The easiest way to get started is to download the library from pypi using pip:
python -m pip install avwx-engine
Reports use ICAO, IATA, or GPS idents when specifying the desired station. Exceptions are thrown if a potentially invalid ident is given.
>>> import avwx
>>>
>>> metar = avwx.Metar('KJFK')
>>> metar.station.name
'John F Kennedy International Airport'
>>> metar.update()
True
>>> metar.data.flight_rules
'IFR'
You can learn more by reading the project documentation
Note: This library requires Python 3.10 or above
Download and install the source code and its development dependencies:
git clone https://github.com/avwx-rest/avwx-engine
cd avwx-engine
Requirements:
Create a virtual environment and install the dependencies
hatch env create
hatch shell
hatch
handles all of the formatting and linting for us. The library and test suite are fully typed and formatted. Make sure to run these checks before submitting PRs because the workflows will fail if errors are found.
Typing with mypy
:
hatch run types:check
Code formatting and linting:
hatch fmt
Testing is managed by hatch
which uses pytest
and coverage under the hood.
hatch test
The end-to-end test files were generated using util/build_tests.py
and placed into tests/{report}/data
. Because Timestamp generation interprets the text based on the current date, Timestamp objects are nullified in the end-to-end tests.
The documentation is automatically generated from the content of the docs directory and from the docstrings of the public signatures of the source code. The documentation is updated and published to engine.avwx.rest automatically as part each release.
You can also preview local changes during development:
hatch run docs:serve
Trigger the Draft release workflow (press Run workflow). This will update the changelog & version and create a GitHub release which is in Draft state.
Find the draft release from the GitHub releases and publish it. When a release is published, it'll trigger release workflow which creates PyPI release and deploys updated documentation.
FAQs
Aviation weather report parsing library
We found that avwx-engine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.