Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
directory-cms-client
Advanced tools
Directory CMS client.
$ pip install directory-cms-client
The api client expects the following settings:
Setting | Notes |
---|---|
DIRECTORY_CMS_API_CLIENT_BASE_URL | |
DIRECTORY_CMS_API_CLIENT_API_KEY | Unique to client. Retrieved during the on-boarding process. |
DIRECTORY_CMS_API_CLIENT_SENDER_ID | Unique to client. Retrieved during the on-boarding process. |
DIRECTORY_CMS_API_CLIENT_DEFAULT_TIMEOUT | |
DIRECTORY_CMS_API_CLIENT_SERVICE_NAME | Unique to client, can be hardcoded. |
The following directory client core settings also apply to directory cms client:
Setting | Notes |
---|---|
DIRECTORY_CLIENT_CORE_CACHE_EXPIRE_SECONDS | Duration to store the retrieved content in the cache. |
DIRECTORY_CLIENT_CORE_CACHE_LOG_THROTTLING_SECONDS | Duration to throttle log events for a given url for. |
And also specify a cache with name cms_fallback
:
CACHES = {
'cms_fallback': ...
}
Once that is done the API client can be used:
from directory_api_client.client import cms_api_client
$ git clone https://github.com/uktrade/directory-cms-client
$ cd directory-cms-client
$ [create virtual environment and activate]
$ make test_requirements
The package should be published to PyPI on merge to master. If you need to do it locally then get the credentials from rattic and add the environment variables to your host machine:
Setting |
---|
DIRECTORY_PYPI_USERNAME |
DIRECTORY_PYPI_PASSWORD |
Then run the following command:
$ make publish
FAQs
Python API client for Directory CMS.
We found that directory-cms-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.