Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is an unofficial Python SDK for the Commercetools platform. It only supports Python 3.6+ and uses type annotation for an improved development experience.
The API is generated using the commercetools api RAML file and uses marshmallow for the serialization and deserialization.
pip install commercetools
.. code-block:: python
from commercetools.platform import Client
client = Client(
client_id="<your-client-id>",
client_secret="<your-client-secret>",
scope=["<scopes>"],
url="https://api.europe-west1.gcp.commercetools.com",
token_url="https://auth.europe-west1.gcp.commercetools.com",
)
product = (
client
.with_project_key("<your-project-key>")
.products()
.with_id("00633d11-c5bb-434e-b132-73f7e130b4e3")
.get())
print(product)
The client can also be configured by setting the following environment variables:
.. code-block:: sh
export CTP_CLIENT_SECRET="<client secret>"
export CTP_CLIENT_ID="<client id>"
export CTP_AUTH_URL="https://api.europe-west1.gcp.commercetools.com"
export CTP_API_URL="https://auth.europe-west1.gcp.commercetools.com"
export CTP_SCOPES="<comma seperated list of scopes>"
And then constructing a client without arguments:
.. code-block:: python
from commercetools.platform import Client
client = Client()
product = (
client
.with_project_key("<your-project-key>")
.products()
.with_id("00633d11-c5bb-434e-b132-73f7e130b4e3")
.get())
print(product)
To release this package first (pip) install bump2version and update the CHANGES file. Then update the version (either major/minor/patch depending on the change)
.. code-block:: sh
bumpversion --tag <major,minor,patch>
bumpversion is naive because it string replaces, so do a sanity check it didn't accidentally update a Pypi dependency. If not, push the code:
.. code-block:: sh
git push --follow-tags
We use GitHub actions so make sure the build succeeds and then go to the tags tab (https://github.com/labd/commercetools-python-sdk/tags).
Click the dots to trigger a release action. Copy the changelog items in the release description and enter the release version. This will upload the release to PyPi.
FAQs
SDK for Commercetools
We found that commercetools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.