
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
formasaurus
Advanced tools
Formasaurus tells you the types of HTML forms and their fields using machine learning
.. image:: https://img.shields.io/pypi/v/Formasaurus.svg :target: https://pypi.python.org/pypi/Formasaurus :alt: PyPI Version
.. image:: https://github.com/scrapinghub/Formasaurus/workflows/tox/badge.svg :target: https://github.com/scrapinghub/Formasaurus/actions :alt: Build Status
.. image:: http://codecov.io/github/scrapinghub/Formasaurus/coverage.svg?branch=master :target: http://codecov.io/github/scrapinghub/Formasaurus?branch=master :alt: Code Coverage
.. image:: https://readthedocs.org/projects/formasaurus/badge/?version=latest :target: http://formasaurus.readthedocs.org/en/latest/?badge=latest :alt: Documentation
.. description starts
Formasaurus is a Python package that tells you the type of an HTML form and its fields using machine learning.
It can detect if a form is a login, search, registration, password recovery, "join mailing list", contact, order form or something else, which field is a password field and which is a search query, etc.
License is MIT.
.. description ends
Check docs <http://formasaurus.readthedocs.org/>_ for more.
Dropped official support for Python 3.8.
The minimum supported versions of some dependencies have changed:
lxml: 4.4.1 → 4.5.2scikit-learn: 0.24.0 → 1.5.0scipy: 1.5.0 → 1.6.2New dependencies have been added:
numpy ≥ 1.19.5packaging ≥ 14.0parsel ≥ 1.1.0platformdirs ≥ 3.2.0The formasaurus.utils.dependencies_string() function is now deprecated.
Added a new function, build_submission, to make Formasaurus easier to
use.
Added a built-in model, so that you can use Formasaurus right away without the need to first train a model on the built-in data.
Changed the model serialization format, to minimize the chance of breakage due to new versions of dependencies.
As a result, when specifying a model path, it is no longer the path to a
single file, but the base path for multiple files. For example, if model
is specified as file path, 2 files are created, model-field.joblib and
model-form.json.
When building a model, if a file path is not specified, the file path used by default is now guaranteed to be user-writable.
Removed the need to specify the [with-deps] or [with_deps] extra when
installing <install.
Improved the docs of formasaurus.classifiers.extract_forms().
Dropped official support for Python 3.7 and lower, and added official support for Python 3.8 and higher.
Added support for the latest versions of all dependencies, and upgraded minimum supported versions of dependencies as follows:
docopt: 0.4.0
requests: 1.0.0
tldextract: 1.2.0
with-deps extra dependencies:
joblib: 1.2.0
lxml: 4.4.1
lxml-html-clean: 0.1.0
scikit-learn: 0.18.0 → 0.24.0
scipy: 1.5.1
sklearn-crfsuite: 0.3.1 → 0.5.1
https://github.com/scrapinghub/formasaurus is the new code repository, replacing https://github.com/TeamHG-Memex/Formasaurus.
Updated the CI configuration and development tooling.
formasaurus init command which trains & caches the model.pip install formasaurus[with-deps] is worked around;
it should work now as pip install formasaurus[with_deps].form_classes and field_classes attributes of FormFieldClassifer;formasaurus.utils.download;fields=False argument is supported in formasaurus.extract_forms,
formasaurus.classify, formasaurus.classify_proba functions and
in related FormFieldClassifier methods. It allows to avoid predicting
form field types if they are not needed.formasaurus.classifiers.instance() is renamed to
formasaurus.classifiers.get_instance().This is a major backwards-incompatible release.
Initial release.
FAQs
Formasaurus tells you the types of HTML forms and their fields using machine learning
We found that formasaurus demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.