
Research
SAP CAP npm Packages Hit by Mini Shai-Hulud Supply Chain Attack
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.
cacahuate
Advanced tools
.. image:: https://travis-ci.org/tracsa/cacahuate.svg?branch=master :target: https://travis-ci.org/tracsa/cacahuate :alt: Build Status
The process virtual machine
This project defines storage for an abstract process in a company, and implements a virtual machine that keeps track of the execution of instances of the process.
You will need the redis and mongo databases, and rabbitmq for this
to work. I recommend using pipenv or virtualenv in your python projetcs ;)
requirements.txtpytest)you can control your cacahuate installation using this three environment variables:
CACAHUATE_SETTINGS: absolute path to a settings file
FLASK_APP: import path to wsgi module (cacahuate.http.wsgi)
FLASK_DEBUG: set to 1 to turn on flask's debugging
.. code-block:: bash
pip install cacahuate
This is the daemon in charge of moving pointers in the process, run with:
.. code-block:: bash
cacahuated
In this same repository you will find a flask application that exposes a REST api for controling Cacahuate.
How to run
.. code-block:: bash
FLASK_APP=cacahuate.http.wsgi flask run
You can use any wsgi-compliant server, like gunicorn, to run this:
.. code-block:: bash
gunicorn cacahuate.http.wsgi:app
Docs are built using sphinx <http://www.sphinx-doc.org/en/master/>_ and published in
https://tracsa.github.io/cacahuate/index.html. To build a local copy of the docs
navigate to the docs/ directory and run:
.. code-block:: bash
make html
For more options just run make by itself.
./release.sh cacahuate/version.txt [major|minor|patch]
FAQs
The process virtual machine
We found that cacahuate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.

Research
/Security News
Socket is tracking cloned Open VSX extensions tied to GlassWorm, with several updated from benign-looking sleepers into malware delivery vehicles.