Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Harmonizer is a library for translating Dune queries from PostgreSQL and Spark SQL to DuneSQL. It currently powers our in-app migration service.
Harmonizer makes heavy use of SQLGlot, an excellent tool for working with SQL queries. With it, we parse the query into an Abstract Syntax Tree (AST), and can manipulate the AST, and finally generate the SQL for that query, even in a different dialect.
We add a DuneSQL dialect, and use SQLGlot to translate from Spark SQL/PostgreSQL to DuneSQL. In the DuneSQL dialect, we translate string literals '0x...' to 0x..., since we support native hex literals.
Harmonizer also does a mapping of known changes in table names from the legacy Postgres datasets to corresponding table names in DuneSQL. We need help to make this mapping more complete!
Install with
pip install dune-harmonizer
Now import the translate_
functions in your code:
from dune.harmonizer import translate_spark, translate_postgres
with function signatures
def translate_spark(query: str) -> str:
...
def translate_postgres(query: str, dataset: str) -> str:
...
Contributions are very welcome!
Please open an issue or PR, and we will get back to you as soon as we can.
If you've found a table that doesn't get mapped to one that exists on Dune SQL, then you can open an issue or just add the table mapping to this line here in a PR.
If there is a function that doesn't get mapped correctly, then you can open an issue or try and add one here using sqlglot and open a PR.
Install with
poetry install
If the Ruff linter complains, running the following and committing the changes should suffice
poetry run ruff . --fix
poetry run black .
Run tests with
poetry run pytest
We test on examples in the test_cases
directory.
To force an update of the expected outputs, run the update_expected_outputs
script like below
poetry run python tests/update_expected_outputs.py
FAQs
Unknown package
We found that dune-harmonizer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.