
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
.. image:: https://img.shields.io/pypi/v/hupper.svg :target: https://pypi.python.org/pypi/hupper
.. image:: https://github.com/Pylons/hupper/actions/workflows/ci-tests.yml/badge.svg?branch=main :target: https://github.com/Pylons/hupper/actions/workflows/ci-tests.yml?query=branch%3Amain
.. image:: https://readthedocs.org/projects/hupper/badge/?version=latest :target: https://readthedocs.org/projects/hupper/?badge=latest :alt: Documentation Status
hupper
is an integrated process monitor that will track changes to
any imported Python files in sys.modules
as well as custom paths. When
files are changed the process is restarted.
Hupper can load any Python code similar to python -m <module>
by using the
hupper -m <module>
program.
.. code-block:: console
$ hupper -m myapp Starting monitor for PID 23982.
Start by defining an entry point for your process. This must be an importable
path in string format. For example, myapp.scripts.serve.main
.
.. code-block:: python
# myapp/scripts/serve.py
import sys
import hupper
import waitress
def wsgi_app(environ, start_response):
start_response('200 OK', [('Content-Type', 'text/plain')])
yield b'hello'
def main(args=sys.argv[1:]):
if '--reload' in args:
# start_reloader will only return in a monitored subprocess
reloader = hupper.start_reloader('myapp.scripts.serve.main')
# monitor an extra file
reloader.watch_files(['foo.ini'])
waitress.serve(wsgi_app)
hupper
is inspired by initial work done by Carl J Meyer and David Glick
during a Pycon sprint and is built to be a more robust and generic version of
Ian Bicking's excellent PasteScript paste serve --reload
and Pyramid's
pserve --reload
.
FAQs
Integrated process monitor for developing and reloading daemons.
We found that hupper demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.