Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The Colony Framework is an open-source plugin framework specification. Its implementations provide a component model at runtime, enabling plugins to be installed, started, stopped, updated, and uninstalled without having to stop the application container. The framework heavily relies on the Inversion of Control principle, making it easier for application components to discover and interact with each other.
Colony's goal is to simplify the process of creating modular applications by offering a unified, simplified model for component development. This can have practical applications in a variety of fields, ranging from modular enterprise software to application mashing.
pip install colony
RUN_MODE=devel colony
virtualenv .venv && source .venv/bin/activate
pip install colony
cpm install console_interface
RUN_MODE=devel colony
mkdir colony && cd colony
Dockerfile
from the repo using wget https://github.com/hivesolutions/colony/raw/master/assets/docker/Dockerfile
docker build --tag self/colony .
docker run -e RUN_MODE=devel -i -t self/colony
To actually do something useful, look into How to Establish your Colony in 3 Easy Steps
PYTHONPATH
to the colony/src
path so that the Python source files may be includedPATH
to the colony/scripts/pypi
to use the provided base scriptspip install colony
Name | Type | Default | Description |
---|---|---|---|
RUN_MODE | str | development | The mode in which the Colony will be running. |
LOGGING_LOGSTASH | bool | False | If the Logstash logging adapter should be enabled. |
Most of the colony operations are run through the cpm
command:
cpm clone <target>
- clones the base colony instance into the target directory (new project)cpm cleanup <target>
- cleans the current instance, removing extra filescpm pack <target>
- packs the current instance into a .zip filecpm generate [target] <...>
- generates a .json descriptor file for the provided Python file and then runs
the build operation for the generated .json file, effectively building the package itemcpm build [descriptor] <...>
- builds the target .json descriptor file into a package filecpm deploy [package]
- deploys the target .cbx file into the current instancecpm info [package]
- prints information about the package to the standard outputcpm install [name] <...>
- installs the package with the provided name from the remote repositoriescpm upgrade
- updates the complete set of packages deployed in the instancecpm require [path] <...>
- installs the complete set of packages defined in the requirements filecpm upload [target] <repo>
- generates a package for the provided path and then uploads it to the currently
configured primary repository or another repository if definedTo run the complete set of available tests for the deployment, use either colony test
or MODE=test colony
and Colony Manager will boot directly to unit testing and exit in error in
case at least one test fails.
And remember, this is just the base runtime. To understand what you can do with Colony, browse the Colony Plugins repository.
Although Colony is still in an early stage, we're welcoming help for all kinds of work. The best ways to get involved:
To find the Python native extension required for some of the plugins, use the following sites:
Colony is an open-source project currently licensed under the Apache License, Version 2.0.
FAQs
Colony Framework
We found that colony demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.