Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Tests Python package sources to see if they build successfully to a PyPi compatible distribution
Checks a Python package intended to be published on PyPi:
.whl
distribution from it?.whl
?Thus, we test the correctness of setup.py
or setup.cfg
.
chkpkg
can be used as part of CI pipeline. The check can be run from a .py
script, which is as cross-platform as Python itself.
chkpkg
supports Python 3.6+ on Linux, macOS and Windows.
pip3 install chkpkg
from chkpkg import Package
with Package() as pkg:
pkg.run_python_code('import mypackage; mypackage.myfunc()')
pkg.run_shell_code('mypackage_cli --version')
print("Package is OK!")
This test script creates a distribution from project sources, installs the package from the distribution into a virtual environment, tries importing and running the installed package from python and command line.
If any results in an error, an exception is thrown. The absence of exceptions means that the package is fine.
By default, we assume that the setup.py
or setup.cfg
is located in the
current working directory. You can specify a different path using the
argument Package(project_dir=...)
Without context, the test script would look like this:
from chkpkg import Package
pkg = Package()
try:
# step 1
pkg.init()
# step 2
pkg.run_python_code('import mypackage; mypackage.myfunc()')
pkg.run_shell_code('mypackage_cli --version')
finally:
# step 3
pkg.cleanup()
pkg.init()
The init
method:
.whl
files
.whl
file (python -m build
)twine check --strict
).whl
into the clean virtual
environmentpkg.run_python_code('import mypackage')
The run_python_code
method allows you to check that the package is installed
and can be imported without errors.
You can also run some functions from the imported package and check the output.
output = pkg.run_python_code('import mypackage; print(mypackage.plus(2, 3))')
assert output == "5"
If the package must be installed as a CLI program, this can be tested with
the run_shell_code
. This function calls cmd.exe
on Windows and bash
on other systems.
output = pkg.run_shell_code('mypackage_cli --version')
assert output[0].isdigit()
The current working directory will be a random temporary one. If mypackage_cli
can be run, then it really is available as a shell command from any directory.
However, such tests are best done on a clean system. If we run the tests on development machine, it may turn out that we are running a command that was in the system before the package was installed.
pkg.cleanup()
The cleanup
method removes all temporary directories created during building
and testing.
Copyright © 2021 Arteom iG. Released under the MIT License.
FAQs
Tests Python package sources to see if they build successfully to a PyPi compatible distribution
We found that chkpkg demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.