
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
buff163-unofficial-api
Advanced tools
An unofficial Python API wrapper for Buff163, a CS skin marketplace.
Install the package with npm
pip install buff163-unofficial-api
Example of using the API to get frontpage items.
from buff163_unofficial_api import Buff163API
# Example cookie format
cookie = "Device-Id=_; Locale-Supported=_; game=_; NTES_YD_SESS=_; S_INFO=_; P_INFO=_; remember_me=_; session=_; csrf_token=_"
buff163api = Buff163API(session_cookie=cookie)
market = buff163api.get_featured_market()
for item in market:
print(f"{item.market_hash_name}")
print(f"¥ {item.sell_min_price}\n")
Be logged into https://buff.163.com & open the site.
Open inspect element.
F12 on Windows | Command + SHIFT + C on Mac.
Click on the "Network" tab at the top.
Refresh the page.
Filter with "api".
Click on any of the results (Ex: popular_sell_order?=#).
On the right scroll down to the "Request Headers" section.
Copy the large "Cookie:" parameter under the request headers.
Set this as the session cookie (Ex: Buff163API(session_cookie="your_cookie")).
For detailed documentation, please refer to:
Any contributions you make are greatly appreciated.
If you have a suggestion that would make this better or see a missing route, please fork the repo and create a pull request. You can also simply open an issue with the tag "contribution". Thanks for taking the time to improve this API wrapper!
git checkout -b feature/AmazingFeature
)git commit -m 'Add some AmazingFeature'
)git push origin feature/AmazingFeature
)Distributed under the MIT License. See LICENSE.md for more information.
Mark Zhdan - markzhdan@gmail.com
Project Link: https://github.com/markzhdan/buff163-unofficial-api
FAQs
An unofficial API wrapper for Buff163, a CS skin marketplace.
We found that buff163-unofficial-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.