
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
bunch
Advanced tools
Bunch is a dictionary that supports attribute-style access, a la JavaScript.
b = Bunch() b.hello = 'world' b.hello 'world' b['hello'] += "!" b.hello 'world!' b.foo = Bunch(lol=True) b.foo.lol True b.foo is b['foo'] True
A Bunch is a subclass of dict; it supports all the methods a dict does:
b.keys() ['foo', 'hello']
Including update():
b.update({ 'ponies': 'are pretty!' }, hello=42) print repr(b) Bunch(foo=Bunch(lol=True), hello=42, ponies='are pretty!')
As well as iteration:
[ (k,b[k]) for k in b ] [('ponies', 'are pretty!'), ('foo', Bunch(lol=True)), ('hello', 42)]
And "splats":
"The {knights} who say {ni}!".format(**Bunch(knights='lolcats', ni='can haz')) 'The lolcats who say can haz!'
Bunches happily and transparently serialize to JSON and YAML.
b = Bunch(foo=Bunch(lol=True), hello=42, ponies='are pretty!') import json json.dumps(b) '{"ponies": "are pretty!", "foo": {"lol": true}, "hello": 42}'
If JSON support is present (json or simplejson), Bunch will have a toJSON() method which returns the object as a JSON string.
If you have PyYAML_ installed, Bunch attempts to register itself with the various YAML Representers so that Bunches can be transparently dumped and loaded.
b = Bunch(foo=Bunch(lol=True), hello=42, ponies='are pretty!') import yaml yaml.dump(b) '!bunch.Bunch\nfoo: !bunch.Bunch {lol: true}\nhello: 42\nponies: are pretty!\n' yaml.safe_dump(b) 'foo: {lol: true}\nhello: 42\nponies: are pretty!\n'
In addition, Bunch instances will have a toYAML() method that returns the YAML string using yaml.safe_dump(). This method also replaces __str__ if present, as I find it far more readable. You can revert back to Python's default use of __repr__ with a simple assignment: Bunch.__str__ = Bunch.__repr__. The Bunch class will also have a static method Bunch.fromYAML(), which loads a Bunch out of a YAML string.
Finally, Bunch converts easily and recursively to (unbunchify(), Bunch.toDict()) and from (bunchify(), Bunch.fromDict()) a normal dict, making it easy to cleanly serialize them in other formats.
It is safe to import * from this module. You'll get: Bunch, bunchify, and unbunchify.
Ample doctests::
$ python -m bunch.test -v
Open a ticket at http://github.com/dsc/bunch or send me an email at dsc@less.ly .
.. _PyYAML: http://pyyaml.org/wiki/PyYAML
FAQs
A dot-accessible dictionary (a la JavaScript objects)
We found that bunch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.