Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Pythonically facilitate laborious file management
, distributed computing
, scripting
and deep learning
workflows.
With this cluster management tool, old laptops and desktops are endowed second lives as cluster workhorses to which you offset heavy computations from your little personal laptop.
sftp
'd automatically to each remote.Croshell aims at facilitating the use of Python in scripting, thus, offering an alternative to PowerShell
& Bash
which have absurdly complex commands that are nothing but jumble of ad-hoc developments piled over decades to save some programmers a key stroke or two. This heritage poses huge burden on the people coming into the computer science field. A full rant bashing those shells by Brian Will
is here.
The core rationale is:
ls
or grep
are, let alone keeping the random syntax in mind (unless used on daily basis).ls
, you need to import some libraries and it will eventually set you back a couple of lines of code. That's not acceptable for the simple task of listing directory contents, let alone a task of compressing a directory.The name crocodile
signifies the use of brute force in its implementation. The focus is on ease of use, as oppoesd to beating the existing shells in speed.
Mind you, speed is not an issue in 99% of everyday chores.
Crocodile
designed carefully to be loved, learning curve cound't be flattened further.
This package extends many native Python classes to equip you with an uneasy-to-tame power. The major classes extended are:
pathlib.Path
is extended to P
os
, glob
, shutil
, sys
, zipfile
etc. P
makes the path an object, not a lame string. P
objects are incredibly powerful for parsing paths, no more than one line of code is required to do any operation. Take a squint at this one line file wrangler:
lol
text to it_copy1
)~
~/Downloads
)~/toy
P.tmpfile().write_text("lol").copy().move("..", rel2it=True).collapseuser().zip().delete(sure=True).touch().parent.search("*", folders=False)[0].share_on_cloud()().download().encrypt(pwd="haha").symlink_from("~/toy").resolve().checksum()
path = P("dataset/type1/meta/images/file3.ext")
>> path[0] # allows indexing! makes sense, hah?
P("dataset")
>> path[-1] # nifty!
P("file3.ext")
>> path[2:-1] # even slicing!
P("meta/images/file3.ext")
list
is extended to List
for
loops exist, because with this class, for
loops are implicitly used to apply a function to all items.
Inevitably while programming, one will encounter objects of the same type and you will be struggling to get a tough grab on them. List
is a powerful structure that put at your disposal a grip, so tough, that the objects you have at hand start behaving like one object. Behaviour is ala-JavaScript implementation of forEach
method of Arrays.dict
is extended to Struct
.
Additionally, the package provides many other new classes, e.g. Read
and Save
. Together with P
, they provide comprehensive support for file management. Life cannot get easier with those. Every class inherits attributes that allow saving and loading in one line.
Furthermore, those classes are inextricably connected. For example, globbing a path P
object returns a List
object. You can move back and forth between List
and Struct
and DataFrame
with one method, and so on.
HParams
class.DataReader
class.BaseModel
is a frontend for both TensorFlow
& Pytorch
backends. The wrapper worked in tandem.In the commandline:
pip install crocodile
.
Being a thin extension on top of almost pure Python, you need to worry not about your venv, the package is not aggressive in requirements, it installs itself peacefully, never interfere with your other packages. If you do not have numpy
, matplotlib
and pandas
, it simply throws ImportError
at runtime, that's it.
For Windows
machines, run the following in elevated PowerShell
:
Warning: This includes dotfiles manager that you might not want.
Invoke-WebRequest https://raw.githubusercontent.com/thisismygitrepo/machineconfig/main/src/machineconfig/setup_windows/croshell.ps1 | Invoke-Expression
That's as easy as taking candy from a baby; whenever you start a Python file, preface it with following in order to unleash the library:
EX1: Get a list of .exe
available in terminal.
P.get_env().PATH.search('*.exe').reduce(lambda x, y: x+y).print()
EX2: Suppose you want to know how many lines of code in your repository. The procedure is to glob all .py
files recursively, read string code, split each one of them by lines, count the lines, add up everything from all strings of code.
To achieve this, all you need is an eminently readable one-liner.
P.cwd().search("*.py", r=True).read_text().split('\n').apply(len).to_numpy().sum()
How does this make perfect sense?
search
returns List
of P
path objectsread_text
is a P
method, but it is being run against List
object. Behind the scenes, responsible black magic fails to find such a method in List
and realizes it is a method of items inside the list, so it runs it against them and thus read all files and containerize them in another List
object and returns it.split
which is a method of strings in Python.apply
is a method of List
. Sure enough, it lives up to its apt name and applies the passed function len
to all items in the list and returns another List
object that contains the results..to_numpy()
converts List
to numpy
array, then .sum
is a method of numpy
, which gives the final result.Methods naming convention like apply
and to_numpy
are inspired from the popular pandas
library, resulting in almost non-existing learning curve.
Please refer to Here on the main git repo.
Click Here
Alex Al-Saffar. email
FAQs
Deep Learning Framework & Workload Management For On-premise Personal Machines.
We found that crocodile demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.