Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a library for Google Nest Device Access using the Smart Device Management API.
This can be used with the sandbox which requires Registration, accepting terms and a fee.
You'll want to following the Get Started guides for setup including steps in the google cloud console. Overall, this is fairly complicated with many steps that are easy to get wrong. It is likely worth it to make sure you can get the API working using their supplied curl commands with your account before attempting to use this library.
This API was designed for use in Home Assistant following the advice in Building a Python Library for an API.
If you are integrating this from outside Home Assistant, you'll need to create your own oauth integration and token refresh mechanism and tooling.
This is an example to use the command line tool to access the API:
PROJECT_ID="some-project-id"
CLIENT_ID="some-client-id"
CLIENT_SECRET="some-client-secret"
# Initial call will ask you to authorize OAuth2 then cache the token
google_nest --project_id="${PROJECT_ID}" --client_id="${CLIENT_ID}" --client_secret="${CLIENT_SECRET}" list_structures
# Subsequent calls only need the project id
google_nest --project_id="${PROJECT_ID}" get_device "some-device-id"
google_nest --project_id="${PROJECT_ID}" set_mode COOL
google_nest --project_id="${PROJECT_ID}" set_cool 25.0
See Device Access: Getting Started: Subscribe to Events for documentation on how to create a pull subscription.
You can create the subscription to use with the tool with these steps:
topic
based on the project_id
Topic Name
Subscription Name
, e.g. "project-id-python" which is your subscriber_id
This is an example to run the command line tool to subscribe:
PROJECT_ID="some-project-id"
SUBSCRIPTION_ID="projects/some-id/subscriptions/enterprise-some-project-id-python-google-nest"
google_nest --project_id="${PROJECT_ID}" subscribe ${SUBSCRIPTION_ID}
$ python3 -m venv venv
$ source venv/bin/activate
$ pip3 install -e .
$ pip3 install -r requirements.txt
# Running tests
$ pytest
# Running tests w/ Code Coverage
$ pytest --cov=google_nest_sdm tests/ --cov-report=term-missing
# Formatting and linting
$ pre-commit run --all-files
If you are interested in donating money to this effort, instead send a donation to Black Girls Code which is a great organization growing the next generation of software engineers.
FAQs
Library for the Google Nest SDM API
We found that google-nest-sdm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.