
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
everybody-codes-data
Advanced tools
This library is used to decrypt input notes for everybody.codes events.
pip install everybody-codes-data
Your auth token should be placed at ~/.config/ecd/token or defined in the ECD_TOKEN environment variable.
Get the token from the "Session Cookie" section on your profile.
There is a getter function ecd.get_inputs which accepts the quest and event, and returns a dict of your decrypted data.
The dict will have string keys "1", "2", "3" corresponding to the puzzle parts.
Inputs are unlocked as you complete subsequent parts, so the dict will have only the key "1" initially.
>>> from ecd import get_inputs
>>> data = get_inputs(quest=3, event=2024)
>>> print(data["1"])
..............................
..............................
.............#................
.............##.#...#.........
..........#.#####...###.......
..........#########.#.........
.........############.........
.........##############.......
.........#############........
..........##.###.##...........
...........#...#.#............
...........#..................
..............................
..............................
There is also a CLI:
$ ecd 3 2024 --part 1
..............................
..............................
.............#................
.............##.#...#.........
..........#.#####...###.......
..........#########.#.........
.........############.........
.........##############.......
.........#############........
..........##.###.##...........
...........#...#.#............
...........#..................
..............................
..............................
See ecd --help for more info on that.
everybody-codes-data can also post answers.
from ecd import submit
submit(quest=1, event=2024, part=1, answer=1323)
If you don't want the submission result printed to the terminal, pass quiet=True.
The result of the submission will be logged (so you may want to configure the logging framework in your project), but if you want to see the result explicitly the return value here is just a urllib3.HTTPResponse instance.
from ecd import submit
result = submit(quest=1, event=2024, part=1, answer=1323, quiet=True)
print(result.status)
print(result.json())
There is also a "magic" interface, similar to advent-of-code-data, where you can use a direct import statement.
To use this feature, you must structure your directories and filenames like ec{event}/q{quest}.py in order that the library can introspect the event/quest from the path.
For example, this structure should work:
my-repo/ec2024/q01.py (event=2024, quest=1)
my-repo/ec2024/q02.py (event=2024, quest=2)
my-repo/ec2025/q01.py (event=2025, quest=1)
Then in your script, the dict of data will be populated from an import statement:
from ecd import data
If you don't want to use this directory structure, call the ecd.get_inputs() function directly instead of using the import syntax. The getter function has no restrictions on script, module or package names.
This library will cache inputs to avoid hitting the server unnecessarily.
Your input data will only be cached locally once all three parts can be decrypted (i.e. once you've solved part 1 and part 2).
There is no caching for partial solves.
Caches are stored at ~/.config/ecd in JSON format, they can be safely removed anytime.
FAQs
Retrieve and decrypt puzzle input data for everybody.codes events
We found that everybody-codes-data demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.