Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Note that relevant info on USGS code distribution and repository metadata can be found at <https://www.usgs.gov/products/software/software-management/distribution-usgs-code>
This repository provides a CLI release tool for use in the repositories of the USGS Engineering Seismology and Impacts Gitlab group.
At present the CLI is a minimally functionally tool to increment major, minor, or patch version numbers in the code and update the project metadata in code.json
accordingly.
For our purposes, this amounts to changing the version
field in code.json
followed by 3 URLs:
disclaimerURL
licenses
URL that exists under the permissions
fieldAt the moment, this tool assumes that the version tag is of the form `v#.#.#`
It can be installed directly from source by calling pip
in the cloned repository base directory:
pip install .
Developers or advanced users may which to include optional dependencies and install in editable mode:
pip install -e .[dev,test,build]
The package is also availbe on PyPI and can be installed with:
pip install esi-releases
This CLI tool allows for three levels of version incrementation, depending on the scope of changes to a repostories code, and attempts to adhere to the conventions of Semantic Versioning
<Major>.<Minor>.<Patch>
The general behavior of this tool is the following:
To initiate a release the following syntax is used:
releases <major|minor|patch>
For example, for a package in a patch
release at the a current version of v1.0.0
:
releases patch
will result in v1.0.1
Should the same package have a following 'minor' release, i.e.:
releases minor
this will result in v1.1.0
Finally, if the package then undergoes a major
release:
releases major
the version will be incremented to v2.0.0
Help can be obtained in the CLI with the following:
releases --help
The intention of this CLI tool is to soon also support automate CHANGELOG.md
updates based on commit messages in the repository, and to also prepare for a release by creating a new version entry. This is currently under development.
FAQs
USGS lightweight utilities for package releases
We found that esi-releases demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.