Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Inmarsat FieldEdge project supports Internet of Things (IoT) using satellite communications technology. Generally this library is meant to be used on single board computers capable of running Debian Linux.
While the authors recognize Python has several shortcomings for embedded use, it provides a useful learning template.
This library available on PyPI provides:
logger
format and wrapping file facility with UTC timestamps.timer.RepeatingTimer
utility (thread) that can be started, stopped,
restarted, and interval changed.mqtt
client that automatically (re)onnects
(by default to a local fieldedge-broker
).path
on different OS.hostpipe
service for sending host
commands from a Docker container, with request/result captured in a logfile.ip.interfaces
for finding and validating IP interfaces
and addresses/subnets.ip.protocols
used for packet analysis and
satellite data traffic optimisation.serial
ports on a host system.timestamp
**s between unix and ISO 8601properties
manipulation and conversion between JSON and PEP style,
and derived from classes or instances.microservice
**s based on MQTT
inter-service communications and task workflows:
interservice
communications tasks and searchable queue.microservice
class for consistent abstraction and interaction.msproxy
microservice proxy class form a kind of twin of another
microservice, as a child of a microservice.feature
class as a child of a microservice, with routing of MQTT
topics and messages and interaction with a simple task queue.propertycache
concept for caching frequently referenced object
properties where the query may take time.subscriptionproxy
allows cascading of received MQTT messages to
multiple modules within a project framing a microservice.FAQs
Utilities package for the FieldEdge project.
We found that fieldedge-utilities demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.