
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
find-ff
Advanced tools
ff is a tool for finding files in the filesystem.
NOTE: ff is in the early stages of development, expect things to break and syntax to change.
ff is a tool for finding files in the filesystem that all share a set of
common features. Its scope is similar to find(1) and fd(1) but it aims at
being more accessible and easier to use than find and more versatile and
powerful than fd. It is written in Python >= 3.6.
Store all files from the current directory that are tracked by git(1) in a
tar(1) archive:
$ ff type=f git.tracked=yes --sort --exec-batch tar cvzf git-tracked.tar.gz
Find files in the directory Videos/ that end with .mkv or .mp4 and are
between 720 and 1080 pixels high:
$ ff Videos/ {{ ext=mkv or ext=mp4 }} and {{ height+=720 and height-=1080 }}
More examples are here.
To build and install ff simply type:
$ python setup.py install
or
$ pip install find-ff
Building with Cython is also supported. Cython >= 3.0 is required. Depending on the set of arguments this may offer a significant speed-up.
$ python setup-cython.py install
You can use ff's query capabilities in your own scripts:
from ff import Find
for entry in Find("type=f git.tracked=yes", directories=["/home/user/project"], sort=["path"]):
print(entry["relpath"])
There is a template for new plugins to start from (plugin_template.py) with
exhaustive instructions and comments, so you can develop plugins for your own
needs.
Useful in that regard is ff's debug mode. It can be activated by executing
the ff module.
$ python -m ff --debug info,cache ...
Debug mode produces lots of messages which can be limited to certain categories
using the --debug category1,category2,... option. On top of that, debug mode
activates many internal checks using assert(). Therefore, it is advisable to
use debug mode during plugin development.
FAQs
A tool for finding files in the filesystem
We found that find-ff demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.