
Research
Malicious fezbox npm Package Steals Browser Passwords from Cookies via Innovative QR Code Steganographic Technique
A malicious package uses a QR code as steganography in an innovative technique.
chat-ideyalabs
Advanced tools
This guide explains how to securely publish the ChatIdeyalabs package to PyPI while keeping sensitive information hidden.
Create a .env
file for local development (DO NOT commit this):
# .env file (for local development only)
CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
CHATIDEYALABS_MONGODB_DATABASE=your_database
CHATIDEYALABS_MONGODB_COLLECTION=apiKeys
CHATIDEYALABS_ENABLE_LOGGING=true
CHATIDEYALABS_LOG_SENSITIVE=false
echo ".env" >> .gitignore
echo "*.env" >> .gitignore
echo "__pycache__/" >> .gitignore
echo "*.pyc" >> .gitignore
echo "dist/" >> .gitignore
echo "build/" >> .gitignore
echo "*.egg-info/" >> .gitignore
pip install build twine
Edit setup.py
:
setup(
name="chat-ideyalabs",
version="0.2.0", # Increment version
# ... rest of setup
)
rm -rf dist/ build/ *.egg-info/
python -m build
This creates:
dist/chat_ideyalabs-0.2.0.tar.gz
dist/chat_ideyalabs-0.2.0-py3-none-any.whl
# Upload to TestPyPI first
python -m twine upload --repository testpypi dist/*
# Test installation from TestPyPI
pip install --index-url https://test.pypi.org/simple/ chat-ideyalabs
python -m twine upload dist/*
Enter your PyPI API token when prompted.
Installation:
pip install chat-ideyalabs
Environment Setup (Required for Users):
Users need to set environment variables:
# Required: LLM configuration (set by admin)
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
# Required: MongoDB configuration for API key validation
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
# Optional: Logging configuration
export CHATIDEYALABS_ENABLE_LOGGING=false
export CHATIDEYALABS_LOG_SENSITIVE=false
Usage:
from chat_ideyalabs import ChatIdeyalabs
# User provides their API key
chat = ChatIdeyalabs(api_key="user-api-key-from-admin")
response = chat.invoke("Hello, world!")
print(response.content)
Set these on your API server:
# Production environment
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
export CHATIDEYALABS_MONGODB_DATABASE=your_database
export CHATIDEYALABS_MONGODB_COLLECTION=apiKeys
export CHATIDEYALABS_ENABLE_LOGGING=true
export CHATIDEYALABS_LOG_SENSITIVE=false
# Dockerfile
FROM python:3.10-slim
ENV CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
ENV CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
ENV CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
COPY . /app
WORKDIR /app
RUN pip install -e .
CMD ["uvicorn", "chat_ideyalabs.api.main:app", "--host", "0.0.0.0", "--port", "8000"]
Create this for your users:
Installation:
pip install chat-ideyalabs
Environment Setup:
# Set the MongoDB connection (provided by admin)
export CHATIDEYALABS_MONGODB_URL=mongodb+srv://username:password@cluster.mongodb.net/database
export CHATIDEYALABS_LLM_BASE_URL=https://your-llm-endpoint.com
export CHATIDEYALABS_LLM_API_KEY=your-llm-api-key-here
Get API Key: Contact your administrator to get an API key.
Usage:
from chat_ideyalabs import ChatIdeyalabs
# Initialize with your API key
chat = ChatIdeyalabs(
api_key="your-api-key-here",
response_format={"type": "json_object"},
temperature=0.7
)
# Basic usage
response = chat.invoke("What is AI?")
print(response.content)
# Async usage
response = await chat.ainvoke("Explain machine learning")
print(response.content)
# Streaming
async for chunk in chat.astream("Write a poem"):
print(chunk, end="", flush=True)
✅ Sensitive data hidden - All secrets in environment variables
✅ No hardcoded credentials - Package safely distributed
✅ User authentication - Each user needs valid API key
✅ Configurable logging - Can disable/mask sensitive data
✅ Easy deployment - Environment-based configuration
.env
files to version controlFAQs
Secure LLM API wrapper with user authentication and request validation
We found that chat-ideyalabs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.
Application Security
/Research
/Security News
Socket detected multiple compromised CrowdStrike npm packages, continuing the "Shai-Hulud" supply chain attack that has now impacted nearly 500 packages.