Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
pip install bmxp
Please cite: https://www.biorxiv.org/content/10.1101/2023.06.09.544417v1.full
This is a collection of tools for processing our data, which powers our cloud processing workflow. Each tool is meant to be a standalone module that performs a step in our processing pipeline. They are written in Python and C, and designed to be perfomant and cloud-compatible.
In the future we will add:
We expect users to be familiar with Python and already have an understanding of LCMS Metabolomics data processing and the specific steps they wish to accomplish.
While the tools are and always will be standalone, we are working on linking them closer together with a shared schema, and eventually may have a pipeline ability to run all steps, given a set of parameters.
We are open to feedback and suggestions, with a focus on performance and application in pipelines.
All BMXP modules use a shared schema and file formats with our prefered columns headers. These files are (along with their labels):
bmxp.FMDATA
- Describes the feature. Index default is Compound_ID
bmxp.IMDATA
- Describes the Injection. Index default is injection_id
bmxp.SMDATA
- Describes the biospecimen from which the Injection is derived. Index default is broad_id
Compound_ID
x injection_id
) containing the abundances.Some modules (Blueshift, Eclipse) require merging Feature Metadata + Feature Abundances.
These can be changed globally so that all packages will use the same terminology. To update the schema, modify the dictionary objects in the module directly prior to running code. For example:
import bmxp
from bxmp.eclipse import MSAligner
from bxmp.blueshift import DriftCorrection
from bmxp.gravity import cluster
bmxp.FMDATA['Compound_ID'] = 'Feature_ID'
bmxp.IMDATA['injection_id'] = 'Filename'
# continue with work...
With those changes above, Eclipse, Blushift and Gravity will use "Feature_ID" and "Filename" as column headers instead of "Compound_ID" and "injection_id".
Feature Metadata describes the LCMS feature. This is a mixture of fundamental nontargeted feature information, annotation info, and anything else.
Compound_ID
- Index, Project-unique feature ID (a bit of a misnomer)RT
- Unitless retention time, may or may not be scaledMZ
- Unsigned mass-to-charge ratioIntensity
- Average feature intensityMethod
- Human Readable name of LCMS method used__extraction_method
- Name of extraction method/software used. Used to denote mixed Targeted/NontargetedAnnotation_ID
- Method-unique annotation labelAdduct
- Adduct form of the annotation__annotation_id
- Globally unique annotation identifierMetabolite
- Preferred display/reporting name of metaboliteNon_Quant
- Boolean denoting that a feature is not quanitifiableCluster_Num
- Cluster number assigned during Gravity clusteringCluster_Size
- Number of members in the clusterBatches Skipped
- Batches that were skipped due to lack of PREFsinjection_id
- Index, Injection name, usually filename without the extensionbroad_id
- Assigned biospeciemn labelprogram_id
- Biospecimen label as received (inherited from Sample Metadata)injection_type
- Type of injection ("sample", "prefa", "prefb", "blank", "other-", "not_used-")comments
- Comments about the injectioncolumn_number
- Column number, in multi-column studiesinjection_order
- Injection number, not skipping blanks or non-samplesbatches
- Denotes batches ('batch start' or 'batch end')QCRole
- Role in drift correction ("QC-drift_correction", "QC-pooled_ref", "QC-not_used", "sample")broad_id
- Assigned biospecimen labelFAQs
LCMS Processing tools used by the Metabolomics Platform at the Broad Institute.
We found that bmxp demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.