
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
Either:
pip install execnb
or if you use conda:
conda install -c fastai execnb
(You can replace conda with mamba in the line above if you have
mamba installed.)
Use
CaptureShell
to run Jupyter code and capture notebook outputs, without running a
Jupyter server (or even having it installed):
from execnb.nbio import *
from execnb.shell import *
from fastcore.utils import *
s = CaptureShell()
s.run('1+1')
[{'data': {'text/plain': ['2']},
'metadata': {},
'output_type': 'execute_result',
'execution_count': 1}]
To execute a notebook and save it with outputs filled in, use
CaptureShell.execute:
try:
s.execute('../tests/clean.ipynb', 'tmp.ipynb')
print(read_nb('tmp.ipynb').cells[1].outputs)
finally: Path('tmp.ipynb').unlink()
[{'name': 'stdout', 'output_type': 'stream', 'text': ['1\n']}, {'data': {'text/plain': ['2']}, 'execution_count': 3, 'metadata': {}, 'output_type': 'execute_result'}]
You can also execute notebooks from the command line with
exec_nb:
!exec_nb --help
usage: exec_nb [-h] [--dest DEST] [--exc_stop] [--inject_code INJECT_CODE]
[--inject_path INJECT_PATH] [--inject_idx INJECT_IDX]
[--verbose]
src
Execute notebook from `src` and save with outputs to `dest`
positional arguments:
src Notebook path to read from
optional arguments:
-h, --help show this help message and exit
--dest DEST Notebook path to write to (default: )
--exc_stop Stop on exceptions? (default: False)
--inject_code INJECT_CODE Code to inject into a cell
--inject_path INJECT_PATH Path to file containing code to inject into a cell
--inject_idx INJECT_IDX Cell to replace with `inject_code` (default: 0)
--verbose Show stdout/stderr during execution (default: False)
FAQs
A description of your project
We found that execnb demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.