
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
comtypes
Advanced tools
comtypes is a lightweight pure Python COM package based on the ctypes foreign function interface library.
comtypes allows you to define, call, and implement custom and dispatch-based COM interfaces in pure Python.
comtypes requires Windows and Python 3.9 or later.
enum behaviorIntFlag(Flag) values is planned to change:IntFlag members will be reinterpreted by masking them to the defined positive bit domain, instead of keeping their original negative literal values.comtypes from COM type libraries. Action is needed to maintain literal evaluation.comtypes functions may not work correctly in Python 3.8 and 3.9 as reported in GH-212. This bug has been fixed in Python >= 3.10.10 and >= 3.11.2.comtypes is available on PyPI and can be installed with pip:
# PyPI
pip install comtypes
The source code is currently hosted here on GitHub.
comtypes is a pure Python package — it has no additional required dependencies.
Optional functionalities can be enabled by installing:
numpy, in order to process arrays as numpy's ndarray.mypy or other static type checkers, in order to interpret type hints.None of these packages, however, are required in order to run comtypes.
The GitHub repository is used for tracking issues, reporting bugs, and contributing to the codebase and documentation.
Available as part of the Tidelift Subscription.
This project and the maintainers of thousands of other packages are working with Tidelift to deliver one enterprise subscription that covers all of the open source you use.
A: The Microsoft Component Object Model (COM) is a technology that is unique to Windows and is not supported on other platforms.
The phrase "COM is a platform-independent" in the MS documentation means that COM maintains compatibility across different versions of Windows, and does NOT imply that it is supported on Linux or Mac.
For as long as COM is not supported outside of Windows, there is no plan to port comtypes to other platforms.
cannot import name 'COMError' from '_ctypes' error occur when using this package on platforms other than Windows?A: The _ctypes is part of the internal implementation of the ctypes standard library that exists for Python on all platforms.
However, COMError and COM-related features are only implemented in Python for Windows.
In cross-platform software development, care must be taken to ensure that codebases that depend on comtypes do not execute in environments other than Windows.
comtypes having run successfully before, a error (ImportError, NameError, or SyntaxError) is raised now, and the same error occurs again and again.A: Executing py -m comtypes.clear_cache and then running the script again might resolve the problem.
When comtypes.client.GetModule is called (either directly or indirectly), comtypes generates Python module files.
If Python is forced to terminate or crashes in the middle of file generation, the codebase written to the file becomes partial.
When Python tries to import this unexecutable partial codebase module, an error occurs.
Executing py -m comtypes.clear_cache identifies the directories where the "cache module files" are stored and deletes them.
After deleting these partial modules and running the script again, comtypes.client.GetModule is called and executable modules are generated anew.
However, if the script implementation does not use comtypes.client.GetModule or processes generated files, it may not be a solution.
The documentation is currently hosted here on ReadTheDocs.
FAQs
Pure Python COM package
We found that comtypes demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.