
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
From German "Herkunft" (origin, provenance)
Track configuration value origins and modification history through YAML parsing with modern Python best practices.
herrkunft is a standalone library extracted from esm_tools that provides transparent provenance tracking for configuration values loaded from YAML files. It tracks:
Perfect for scientific computing, workflow configuration, and any application where configuration traceability matters.
Launch interactive notebooks in your browser (no installation required):
pip install herrkunft
For development:
pip install herrkunft[dev]
from provenance import load_yaml
# Load a configuration file with provenance tracking
config = load_yaml("config.yaml", category="defaults")
# Access values normally
database_url = config["database"]["url"]
print(database_url) # postgresql://localhost/mydb
# Access provenance information
print(database_url.provenance.current.yaml_file) # config.yaml
print(database_url.provenance.current.line) # 15
print(database_url.provenance.current.column) # 8
from provenance import ProvenanceLoader
# Set up hierarchy: defaults < user < production
loader = ProvenanceLoader()
# Load multiple configs with different priorities
defaults = loader.load("defaults.yaml", category="defaults")
user_config = loader.load("user.yaml", category="user")
prod_config = loader.load("production.yaml", category="production")
# Merge with automatic conflict resolution
from provenance import HierarchyManager
hierarchy = HierarchyManager(["defaults", "user", "production"])
final_config = hierarchy.merge(defaults, user_config, prod_config)
# Production values override user values, which override defaults
# Full history is preserved in provenance
from provenance import dump_yaml
# Save configuration with provenance as inline comments
dump_yaml(config, "output.yaml", include_provenance=True)
Output:
database:
url: postgresql://localhost/mydb # config.yaml:15:8
port: 5432 # config.yaml:16:8
herrkunft is built with modern Python best practices:
herrkunft/
├── core/ # Provenance tracking and hierarchy management
├── types/ # Type wrappers (DictWithProvenance, etc.)
├── yaml/ # YAML loading and dumping
├── utils/ # Utilities for cleaning, validation, serialization
└── config/ # Library configuration and settings
Track which configuration file and parameters were used for each simulation run:
config = load_yaml("simulation.yaml")
run_simulation(config)
# Later, audit which file provided each parameter
for key, value in config.items():
print(f"{key}: {value.provenance.current.yaml_file}")
Manage development, staging, and production configs with clear conflict resolution:
loader = ProvenanceLoader()
config = loader.load_multiple([
("defaults.yaml", "defaults"),
("production.yaml", "production"),
("secrets.yaml", "secrets"), # Highest priority
])
Export complete provenance history for compliance or debugging:
from provenance import to_json
# Export config with full provenance metadata
to_json_file(config, "audit.json")
Full documentation is available at https://herrkunft.readthedocs.io
git clone https://github.com/pgierz/herrkunft.git
cd herrkunft
pip install -e .[dev]
pytest # Run all tests
pytest --cov=provenance # With coverage
pytest -v tests/test_core/ # Specific test directory
black provenance tests # Format code
ruff provenance tests # Lint
mypy provenance # Type check
Contributions are welcome! Please see CONTRIBUTING.md for guidelines.
MIT License - see LICENSE for details.
Extracted from the esm_tools project, which provides workflow management for Earth System Models. The provenance tracking feature was originally developed to track configuration origins in complex HPC simulation workflows.
If you use herrkunft in your research, please cite:
@software{herrkunft2024,
title = {herrkunft: Configuration Provenance Tracking for Python},
author = {Gierz, Paul and Andrés-Martínez, Miguel},
year = {2024},
url = {https://github.com/pgierz/herrkunft}
}
FAQs
Track configuration value origins and modification history through YAML parsing
We found that herrkunft demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.