
Research
/Security News
60 Malicious Ruby Gems Used in Targeted Credential Theft Campaign
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
This guide explains how to securely publish the ChatIdeyalabs package to PyPI while keeping sensitive information hidden.
Create a .env
file for local development (DO NOT commit this):
# .env file (for local development only)
CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
CHATIDEYALABS_MONGODB_DATABASE=your_database
CHATIDEYALABS_MONGODB_COLLECTION=apiKeys
CHATIDEYALABS_ENABLE_LOGGING=true
CHATIDEYALABS_LOG_SENSITIVE=false
echo ".env" >> .gitignore
echo "*.env" >> .gitignore
echo "__pycache__/" >> .gitignore
echo "*.pyc" >> .gitignore
echo "dist/" >> .gitignore
echo "build/" >> .gitignore
echo "*.egg-info/" >> .gitignore
pip install build twine
Edit setup.py
:
setup(
name="chat-ideyalabs",
version="0.2.0", # Increment version
# ... rest of setup
)
rm -rf dist/ build/ *.egg-info/
python -m build
This creates:
dist/chat_ideyalabs-0.2.0.tar.gz
dist/chat_ideyalabs-0.2.0-py3-none-any.whl
# Upload to TestPyPI first
python -m twine upload --repository testpypi dist/*
# Test installation from TestPyPI
pip install --index-url https://test.pypi.org/simple/ chat-ideyalabs
python -m twine upload dist/*
Enter your PyPI API token when prompted.
Installation:
pip install chat-ideyalabs
Environment Setup (Required for Users):
Users need to set environment variables:
# Required: LLM configuration (set by admin)
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
# Required: MongoDB configuration for API key validation
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
# Optional: Logging configuration
export CHATIDEYALABS_ENABLE_LOGGING=false
export CHATIDEYALABS_LOG_SENSITIVE=false
Usage:
from chat_ideyalabs import ChatIdeyalabs
# User provides their API key
chat = ChatIdeyalabs(api_key="user-api-key-from-admin")
response = chat.invoke("Hello, world!")
print(response.content)
Set these on your API server:
# Production environment
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
export CHATIDEYALABS_MONGODB_DATABASE=your_database
export CHATIDEYALABS_MONGODB_COLLECTION=apiKeys
export CHATIDEYALABS_ENABLE_LOGGING=true
export CHATIDEYALABS_LOG_SENSITIVE=false
# Dockerfile
FROM python:3.10-slim
ENV CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
ENV CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
ENV CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
COPY . /app
WORKDIR /app
RUN pip install -e .
CMD ["uvicorn", "chat_ideyalabs.api.main:app", "--host", "0.0.0.0", "--port", "8000"]
Create this for your users:
Installation:
pip install chat-ideyalabs
Environment Setup:
# Set the MongoDB connection (provided by admin)
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
Get API Key: Contact your administrator to get an API key.
Usage:
from chat_ideyalabs import ChatIdeyalabs
# Initialize with your API key
chat = ChatIdeyalabs(
api_key="your-api-key-here",
response_format={"type": "json_object"},
temperature=0.7
)
# Basic usage
response = chat.invoke("What is AI?")
print(response.content)
# Async usage
response = await chat.ainvoke("Explain machine learning")
print(response.content)
# Streaming
async for chunk in chat.astream("Write a poem"):
print(chunk, end="", flush=True)
✅ Sensitive data hidden - All secrets in environment variables
✅ No hardcoded credentials - Package safely distributed
✅ User authentication - Each user needs valid API key
✅ Configurable logging - Can disable/mask sensitive data
✅ Easy deployment - Environment-based configuration
.env
files to version controlFAQs
Secure LLM API wrapper with user authentication and request validation
We found that chat-ideyalabs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A RubyGems malware campaign used 60 malicious packages posing as automation tools to steal credentials from social media and marketing tool users.
Security News
The CNA Scorecard ranks CVE issuers by data completeness, revealing major gaps in patch info and software identifiers across thousands of vulnerabilities.
Research
/Security News
Two npm packages masquerading as WhatsApp developer libraries include a kill switch that deletes all files if the phone number isn’t whitelisted.