
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
.. image:: https://api.travis-ci.org/moremoban/gease.svg :target: http://travis-ci.org/moremoban/gease
.. image:: https://codecov.io/github/moremoban/gease/coverage.png :target: https://codecov.io/github/moremoban/gease .. image:: https://badge.fury.io/py/gease.svg :target: https://pypi.org/project/gease
.. image:: https://pepy.tech/badge/gease/month :target: https://pepy.tech/project/gease/month
.. image:: https://img.shields.io/github/stars/moremoban/gease.svg?style=social&maxAge=3600&label=Star :target: https://github.com/moremoban/gease/stargazers
.. image:: https://img.shields.io/static/v1?label=continuous%20templating&message=%E6%A8%A1%E7%89%88%E6%9B%B4%E6%96%B0&color=blue&style=flat-square :target: https://moban.readthedocs.io/en/latest/#at-scale-continous-templating-for-open-source-projects
.. image:: https://img.shields.io/static/v1?label=coding%20style&message=black&color=black&style=flat-square :target: https://github.com/psf/black
It's understood that you may use github cli, however gease simply makes a git release using github api v3.
.. image:: https://github.com/moremoban/gease/raw/master/images/cli.png :width: 600px
You can install gease via pip:
.. code-block:: bash
$ pip install gease
or clone it and install it:
.. code-block:: bash
$ git clone https://github.com/moremoban/gease.git
$ cd gease
$ python setup.py install
First, please create personal access token
for yourself
on github <https://help.github.com/articles/creating-a-personal-access-token-for-the-command-line/>
_.
.. image:: https://github.com/moremoban/gease/raw/master/images/generate_token.png
Next, please create a gease file(.gease
) in your home directory and place the
token inside it. Gease file is a simple json file. Here is an example::
{"user":"chfw","personal_access_token":"AAFDAFASDFADFADFADFADFADF"}
In order to make a release for your organisation, "read:org" right is required:
.. image:: https://user-images.githubusercontent.com/4280312/33229231-0220f60e-d1c3-11e7-8c95-3e1207415929.png
::
gease simply makes a git release using github api v3. version 0.0.1
Usage: gs repo tag [release message]
where:
release message is optional. It could be a quoted string or space separate
string
Examples:
gs gease v0.0.1 first great release
gs gease v0.0.2 "second great release"
:: contributors list the contributors of a repo. version 0.0.4
Usage: contributors user/org repo
Where: user/org is the your github username or orgnisation name repo is the repository name
Examples:
contributors pyexcel pyexcel-io
MIT
Updated
#. #14 <https://github.com/moremoban/gease/issues/14>
_: failed to use public
apis
Updated
#. #3 <https://github.com/moremoban/gease/issues/3>
_: include license, tests
and docs in the package
Updated
#. return all user details using github token if exist. otherwise use public api under quota
Updated
#. return all user details per github user api #. handle 403 and throw out unknown status code
Updated
#. raise UrlNotFound when request a non-existent url
Updated
#. #1 <https://github.com/moremoban/gease/issues/1>
_: access repo contributors
without github token.
Added
#. use login name if full name of the contributor is null
Added
#. get contributors of a github repo
Added
#. #1 <https://github.com/moremoban/gease/issues/1>
_: release repos of the
organisation that you belong to.
Added
#. quit with -1 if github responds with error
Added
#. First release.
FAQs
simply makes a git release using github api v3
We found that gease demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.