Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This repository contains a pragmatic data model for the entities most commonly used in investigative reporting: people, companies, assets, payments, court cases, etc.
The purpose of this is not to model reality in an ideal data model, but rather to have a working data structure for researchers.
followthemoney
also contains code used to validate and normalize many
of the elements of data, and to map tabular data into the model.
For a general introduction to followthemoney
, check the high-level introduction:
Part of this package is a command-line tool that can be used to process and transform data in various ways. You can find a tutorial here:
Besides the introductions, there is also a full reference documentation for the library and the contained ontology:
There's also a number of viewers for the RDF schema definitions generated from FollowTheMoney, e.g.:
For local development with a virtualenv:
python3 -mvenv .env
source .env/bin/activate
pip install -e ".[dev]"
Now you can run the tests with
make test
We release a lot of version of followthemoney
because even small changes
to the code base require a pypi release to begin being used in aleph
. To
this end, here's the steps for making a release:
git pull --rebase
make build
make test
git add . && git commit -m "Updating translation files"
bumpversion patch
git push --atomic origin main $(git describe --tags --abbrev=0)
This will create a new patch release and upload a distribution of it. If
the changes are more significant, you can run bumpversion
with the minor
or major
arguments.
When the schema is updated, please update the docs, ideally including the
diagrams. For the RDF namespace and JavaScript version of the model,
run make generate
.
FAQs
Unknown package
We found that followthemoney demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.