Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Check out the DIDKit documentation here.
DIDKit provides Verifiable Credential and Decentralized Identifier
functionality across different platforms. It was written primarily in Rust due
to Rust's expressive type system, memory safety, simple dependency web, and
suitability across different platforms including embedded systems. DIDKit
embeds the ssi
library, which contains the
core functionality.
DIDKit is available on PyPI.
You can install it globally with:
$ pip install -U didkit
asyncio
is required, meaning you will need Python 3.7 or above.
$ maturin build
You can install
maturin
withpip install maturin
.
Now the wheel
should be in the target directory.
To enable or disable certain features of DIDKit, or use different cryptography
backends, you will need edit the Cargo.toml
.
When adding a function or changing the signature of an existing one, make sure to reflect the changes in the stub file. This is important for static analysis and IDE support. (This will be automated in the future.)
poetry install
poetry run maturin develop
poetry run pytest
Functions have kept the same signatures, but some have become asynchronous. You
will need to start using
asyncio
if it is not already
the case.
Please note: this readme documents an early-stage open-source product ported manually to python, and we are still incorporating feedback from our first comprehensive third-party code audit. These artefacts are presented as functional "betas" for experimentation and to show the direction of the project (inviting proposals for changes of direction, even!). They are not, however, intended for transacting real-world business yet.
FAQs
Library for Verifiable Credentials and Decentralized Identifiers.
We found that didkit demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.