
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
glom
Advanced tools
Restructuring data, the Python way
Real applications have real data, and real data nests. Objects inside of objects inside of lists of objects.
glom is a new and powerful way to handle real-world data, featuring:
All of that and more, available as a fully-documented, pure-Python package, tested on Python 3.7-3.14, as well as PyPy3. Installation is as easy as:
pip install glom
And when you install glom, you also get the glom command-line
interface, letting you experiment at the console, but never limiting
you to shell scripts:
Usage: glom [FLAGS] [spec [target]]
Command-line interface to the glom library, providing nested data access and data
restructuring with the power of Python.
Flags:
--help / -h show this help message and exit
--target-file TARGET_FILE path to target data source (optional)
--target-format TARGET_FORMAT
format of the source data (json, python, toml,
or yaml) (defaults to 'json')
--spec-file SPEC_FILE path to glom spec definition (optional)
--spec-format SPEC_FORMAT format of the glom spec definition (json, python,
python-full) (defaults to 'python')
--indent INDENT number of spaces to indent the result, 0 to disable
pretty-printing (defaults to 2)
--debug interactively debug any errors that come up
--inspect interactively explore the data
Anything you can do at the command line readily translates to Python code, so you've always got a path forward when complexity starts to ramp up.
>>> data = {'a': {'b': {'c': 'd'}}}
>>> data['a']['b']['c']
'd'
>>> data2 = {'a': {'b': None}}
>>> data2['a']['b']['c']
Traceback (most recent call last):
...
TypeError: 'NoneType' object is not subscriptable
>>> glom(data, 'a.b.c')
'd'
>>> glom(data2, 'a.b.c')
Traceback (most recent call last):
...
PathAccessError: could not access 'c', index 2 in path Path('a', 'b', 'c'), got error: ...
If all this seems interesting, continue exploring glom below:
All of the links above are overflowing with examples, but should you find anything about the docs, or glom itself, lacking, please submit an issue!
In the meantime, just remember: When you've got nested data, glom it! âď¸
FAQs
A declarative object transformer and formatter, for conglomerating nested data.
We found that glom demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.