Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Command | Description |
---|---|
black | Runs black. |
coverage-open | Open coverage results in default browser. |
coverage-report | Analyse coverage and generate a term/HTML report. |
dependencies-update | Manages the process of updating dependencies. |
ensure-pre-commit | Ensures pre-commit is installed and enabled. |
format | Runs ensure-pre-commit, pyupgrade, isort, black. |
gh | Extends gh or passes through. |
glab | Extends glab or passes through. |
isort | Runs isort. |
lint | Runs ruff, pylint, pycodestyle, pydocstyle. |
mypy | Run type checking on source code. |
pre-commit | Run all pre-commit stages in the current project... |
pycodestyle | Run PEP8 checking on code. |
pydocstyle | Run docstring linting on source code. |
pylint | Run pylint on code. |
pytest | Runs pytest for individual test suites. |
pytest-integration | Run integration tests. |
pytest-unit | Run unit tests. |
pyupgrade | Runs pyupgrade with automatic version discovery. |
ruff | Run ruff. |
switch-python-version | Switches Python venv to a different Python version. |
test | Runs pytest, coverage-report. |
vcs | Alias for gh /glab with auto-detection. |
verify | Runs format, lint, mypy, test. |
pip install delfino-core
poetry add -D delfino-core
pipenv install -d delfino-core
Each project may use different sub-set of commands. Therefore, dependencies of all commands are optional and checked only when the command is executed.
Using [all]
installs all the optional dependencies used by all the commands. If you want only a sub-set of those dependencies, there are finer-grained groups available:
mypy
format
dependencies-update
pre-commit
vsc
test
- for testing and coverage commandslint
- for all the linting commandsverify
- same as [mypy,format,test,lint]
all
- all optional packagesDelfino doesn't load any plugins by default. To enable this plugin, add the following config into pyproject.toml
:
[tool.delfino.plugins.delfino-core]
This plugin has several options. All the values are optional and defaults are shown below:
[tool.delfino.plugins.delfino-core]
# Source files - may have different rules than tests (usually stricter)
sources_directory = "src"
# Test files
tests_directory = "tests"
# Where to store reports generated by various tools
reports_directory = "reports"
# Types of tests you have nested under the `tests_directory`. Will be executed in given order.
test_types = ["unit", "integration"]
# One or more module to wrap `pytest` in, executing it as `python -m <MODULE> pytest ...`
pytest_modules = []
# Coommand groups and commands to run as a quality gate in given order.
verify_commands = ["format", "lint", "mypy", "test"]
format_commands = ["ensure-pre-commit", "pyupgrade", "isort", "black"]
lint_commands = ["ruff", "pylint", "pycodestyle", "pydocstyle"]
test_commands = ["pytest", "coverage-report"]
# Do not install pre-commit if this is set to true.
disable_pre_commit = false
Several commands have their own configuration as well.
mypy
[tool.delfino.plugins.delfino-core.mypy]
# One or more directories where type hint will be required. By default they are optional.
strict_directories = []
vcs
[tool.delfino.plugins.delfino-core.vcs]
# Enable to manually specify the branch prefix. By default it is set to git username.
# branch_prefix = ""
[tool.delfino.plugins.delfino-core.vcs.issue_tracking]
# Prefix for issue numbers, including a trailing hyphen if used. If not set, just the issue numbers will be used.
# issue_prefix = "ISSUE-"
# URL for the issue tracker. If not set, issue tracker integration will be disabled.
# Implemented trackers: Jira.
# tracker_url = "https://<SUBDOMAIN>.atlassian.net"
# Environment variable name for the issue tracking username. If not set, 'ISSUE_TRACKER_USERNAME' will be used by default.
# username_env_var = ""
# Environment variable name for the issue tracking API key. If not set, 'ISSUE_TRACKER_API_KEY' will be used by default.
# api_key_env_var = ""
Run delfino --help
.
To develop against editable delfino
sources:
delfino
sources are next to this plugin:
cd ..
git clone https://github.com/radeklat/delfino.git
delfino
as editable package:
pip install -e ../delfino
Note that poetry will reset this to the released package when you install/update anything.FAQs
Delfino core plugin
We found that delfino-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.