
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Django app that offers a big red button to sign out of all other user sessions
django-bigredbutton provides a big red "End All Other Sessions" button in a list of a user's current sessions.
Rendered with a light theme:
Rendered with a dark theme:
It can work with multiple session backends, and includes built-in templates for both django-qsessions and django-user-sessions, and dynamically switches between them depending on which one is identified in settings.SESSION_ENGINE
.
Install the latest version:
pip install django-bigredbutton
poetry add django-bigredbutton
Add a session backend, like django-qsessions or django-user-sessions. You can use the optional packaging shortcuts:
pip install 'django-bigredbutton[qsessions]'
poetry add 'django-bigredbutton[qsessions]'
pip install 'django-bigredbutton[user-sessions]'
poetry add 'django-bigredbutton[user-sessions]'
But there may be additional steps required for each session backend. Refer to the documentation for your session backend package for their installation instructions.
Add bigredbutton
to INSTALLED_APPS
in your project's settings.py
, and
optionally set BIGREDBUTTON_DELETE_SUCCESS_URL_NAME
to the URL name of
your choice (default: list_sessions
).
Register bigredbutton
in your projects root URLConf:
urlpatterns = [
...
path("account/sessions/", include("bigredbutton.urls")),
...
]
Run Django's development server and navigate to the configured root for
bigredbutton
. The URL in these instructions will be
http://localhost:8000/account/sessions/
.
You will see a list of all of your current sessions. If you have more than one session (eg: you are signed in on more than one browser or device), you will see a big red "End All Other Sessions" button. That button will sign you out of all of your other sessions.
I have intentionally kept this app very small to minimize the maintenance burden. But contributions are very welcome!
MIT
FAQs
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.