Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Installation | Usage | Testing | License
globmatch
provides functions for matching a path against one ore more glob patterns in Python.
This differs from the glob
module of the standard library, which matches a glob against the
file-tree on your system. globmatch
does not interact with the filesystem at all, but relies on
generic matching. It also differs from the fnmatch
module of the standard library in that it
accepts the double star (**
) element, which matches zero or more directories. Additionally, the
star element (*
) in fnmatch
will also match across path separators. In globmatch
the
star element matches zero or more characters of the current path element (directory/file name).
Install globmatch with pip:
pip install globmatch
or for a development install:
pip install -e git+https://github.com/vidartf/globmatch#egg=globmatch
from globmatch import glob_match
# Some paths that match (returns True):
glob_match('.git/gitconfig/', ['.git'])
glob_match('foo/config', ['**/config'])
glob_match('foo/config/bar', ['**/config'])
glob_match('.git/gitconfig/', ['.git', '**/config'])
glob_match('foo/config/bar', ['.git', '**/config'])
glob_match('/.git/gitconfig/', ['**/.git'])
# Some paths that do not match (returns False):
glob_match('/.git/gitconfig/', ['.git']) # Needs ** to match subdir of root dir
glob_match('foo/node_modules', ['node_modules']) # Will not match subdir without preceding **
Install the develop install with test requirements:
pip install -e globmatch[test]
To run Python tests locally, enter on the command line: pytest
Install the codecov browser extension to view test coverage in the source browser on github.
All code is licensed under the terms of the revised BSD license.
FAQs
Matching paths against globs
We found that globmatch demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.