Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Inspect the caller.
You might simply install it with pip:
pip install backframe
If you use Poetry, then you might want to run:
poetry add backframe
[!Note] If you use Windows, it is highly recommended to complete the installation in the way presented below through WSL2.
Fork the backframe repository on GitHub.
Install Poetry.
Poetry is an amazing tool for managing dependencies & virtual environments, building packages and publishing them.
You might use pipx to install it globally (recommended):
pipx install poetry
If you encounter any problems, refer to the official documentation for the most up-to-date installation instructions.
Be sure to have Python 3.8 installed—if you use pyenv, simply run:
pyenv install 3.8
Clone your fork locally and install dependencies.
git clone https://github.com/your-username/backframe path/to/backframe
cd path/to/backframe
poetry env use $(cat .python-version)
poetry install
Next up, simply activate the virtual environment and install pre-commit hooks:
poetry shell
pre-commit install
For more information on how to contribute, check out CONTRIBUTING.md.
Always happy to accept contributions! ❤️
© Copyright by Bartosz Sławecki (@bswck).
This software is licensed under the terms of MIT License.
FAQs
Inspect the caller.
We found that backframe demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.