Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
It is a package that supports common utils used by FOSSLight Scanner.
FOSSLight Util needs a Python 3.6+.
It can be installed using pip3.
$ pip3 install fosslight_util
Three modules can be called. Please refer to each file for detailed calling method.
from fosslight_util.set_log import init_log
# 1st param : log file path
# 2nd param : create file (True/False)
# 3rd param : stream log level
# 4th param : file log level
# =>log level(CRITICAL:50, ERROR:40, WARNING:30, INFO:20, DEBUG:10, NOTSET:0)
# 5th param : package name of fosslight scanners (fosslight_source / fosslight_dependency / fosslight_reuse)
# 6th param : path to analyze
#
# 1st return value : a logger
# 2nd return value : log items to print
def test():
logger, log_item = init_log("test_result/log_file1.txt", True, 30, 20)
logger.warning("TESTING - Print log")
from fosslight_util.output_format import write_output_file
# 2nd param : output file format
# => file format(excel: .xlsx, csv: .csv, opossum: .json)
def test():
sheet_contents = {'SRC':[['run_scancode.py', 'fosslight_source',
'3.0.6', 'Apache-2.0', 'https://github.com/LGE-OSS/fosslight_source', 'https://github.com/LGE-OSS/fosslight_source', 'Copyright (c) 2021 LG Electronics, Inc.', 'Exclude', 'Comment message'],
['dependency_unified.py', 'fosslight_dependency',
'3.0.6', 'Apache-2.0', 'https://github.com/LGE-OSS/fosslight_dependency', 'https://github.com/LGE-OSS/fosslight_dependency', 'Copyright (c) 2020 LG Electronics, Inc.', '', '']],
'BIN':[['askalono.exe', 'askalono',
'0.4.3', 'Apache-2.0', 'https://github.com/jpeddicord/askalono', '', 'Copyright (c) 2018 Amazon.com, Inc. or its affiliates.', '', '']]}
success, msg = write_output_file('test_result/excel/FOSSLight-Report', '.xlsx', sheet_contents)
from fosslight_util.spdx_licenses import get_spdx_licenses_json
def test():
success, error_msg, licenses = get_spdx_licenses_json()
import fosslight_util.constant as constant
logger = logging.getLogger(constant.LOGGER_NAME)
logger.warning("Get a logger after init_log is called once.")
from fosslight_util.timer_thread import TimerThread
timer = TimerThread()
timer.setDaemon(True)
timer.start()
If you give a link, the source is downloaded to the target directory through git clone or wget.
Parameter | Argument | Description |
---|---|---|
h | None | Print help message. |
s | String | Link to download. |
t | String | Path to download and extract. |
d | String | Path to save a log file. |
$ fosslight_download -s "https://github.com/LGE-OSS/example" -t target_dir/
If you want to try with private repository, set your github token like below.
$ fosslight_download -s "https://my_github_token@github.com/Foo/private_repo -t target_dir/"
Please report any ideas or bugs to improve by creating an issue in fosslight_util repository. Then there will be quick bug fixes and upgrades. Ideas to improve are always welcome.
FOSSLight Util is released under Apache-2.0.
FAQs
FOSSLight Util
We found that fosslight-util demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.