Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Foodx DevOps pipeline utilities.
.. contents::
.. section-numbering::
The foodx_devops_tools
package is available from PyPI. Installing into a virtual
environment is recommended.
.. code-block::
python3 -m venv .venv; .venv/bin/pip install foodx_devops_tools
The first time you clone this project use the following command to set up the virtual environment for the project. Ensure that you have Python3, git and the Python package venv installed on your system.
Note that while venv
is in the Python standard library, in Ubuntu it is not installed with the standard Python 3
apt package so you must explicitly install it with sudo apt install python3-venv
.
.. code-block::
git clone <foodx_devops_tools repo url> cd foodx_devops_tools python3 -m venv .venv; .venv/bin/pip install build_harness; .venv/bin/build-harness install
Run the same static analysis as the pipeline using the build-harness
utility:
.. code-block::
build-harness formatting
build-harness static-analysis
build-harness unit-test --test-dir tests/ci
build-harness unit-test --test-dir tests/ci --coverage-html
Examine the .gitlab-ci.yml
file for more examples of using the build-harness
utility.
FAQs
Foodx DevOps pipeline utilities.
We found that foodx-devops-tools demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.