Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
directory-client-core
Advanced tools
Directory Client Core.
pip install directory-client-core
from directory_client_core.base import AbstractAPIClient
class MyAPIClient(AbstractAPIClient):
version = 1 # passed as a header in all requests
def get_something(self):
return self.get(...)
def create_sometime(self):
return self.post(...)
client = MyAPIClient(
base_url='https://example.com/',
api_key='test',
sender_id='test-sender-id',
timeout=2,
)
response = client.get_something()
The decorator directory_client_core.helpers.fallback
can be used to cache the responses from the remote server, allowing the cached content to be later used if the remote server does not return the up to date live content (maybe it times out, maybe the server is down). This decorator also saves etag response headers to later expose them in requests and respect 304 (Not modified) response and serve already cached contents.
# settings.py
DIRECTORY_CLIENT_CORE_CACHE_EXPIRE_SECONDS = 60 * 60 * 24 * 30 # 30 days
# client.py
from django.core.cache import caches
from directory_client_core import helpers
from directory_client_core.base import AbstractAPIClient
class APIClient(AbstractAPIClient):
version = 1
@helpers.fallback(cache=caches['fallback'])
def get(self, *args, **kwargs):
return super().get(*args, **kwargs)
def retrieve(self):
return self.get(url='/some/path/')
The fallback
creates log entries when cache events occur. To reduce noise DIRECTORY_CLIENT_CORE_CACHE_LOG_THROTTLING_SECONDS
can be set in settings. This will result in a log event being created only once every period of time. By default this means seeing "cache hit for url x" (for a given url) is shown once every 24 hours.
$ git clone https://github.com/uktrade/directory-client-core
$ cd directory-client-core
$ make test_requirements
The package should be published to PyPI on merge to master. If you need to do it locally then get the credentials from rattic and add the environment variables to your host machine:
Setting |
---|
DIRECTORY_PYPI_USERNAME |
DIRECTORY_PYPI_PASSWORD |
Then run the following command:
make publish
FAQs
Python common code for Directory API clients.
We found that directory-client-core demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.