Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
An elfinder connector built with FastAPI, specifically for working with jupyter server proxy.
A web file browser for managing data on remote jupyter servers, specifically built for the ImJoy project, an open source platform for deploying computational tools to the end user.
The frontend is built with elFinder and a Python backend server.
elFinder is an open-source file manager for web, written in JavaScript using jQuery and jQuery UI, the project is maintained by Studio 42.
Python 3.7+ is required.
pip install -U imjoy-elfinder
In your terminal, run the following command:
imjoy-elfinder --thumbnail
(The thumbnail option enables thumbnail for images, it will create a folder named .tmb
under your current folder, you can also disable that by remove the --thumbnail
option.)
You will then see the following message:
==========ImJoy elFinder server is running=========
http://127.0.0.1:8765
Depending on where you started the command, the file browser will show your current folder as root directory or HOME.
In order to browse your own directory, you can manually set the root directory by passing --root-dir=/PATH/TO/MY/FOLDER
.
If you don't have jupyter notebook, run:
pip install -U jupyter
Next, install ImJoy elFinder with jupyter server proxy extension:
pip install -U imjoy-elfinder[jupyter]
Now start Jupyter notebook as you would do normally, for example:
jupyter notebook --ip=0.0.0.0
You will get a web file browser at http://YOUR_NOTEBOOK_URL/elfinder
(depending on what you get from your notebook, for example, the url can be http://localhost:8000/elfinder
).
Start an instance on MyBinder: https://mybinder.org/v2/gh/imjoy-team/imjoy-elfinder/master?urlpath=elfinder
You should be able to see a file browser.
Please be aware that there is potential risk to use ImJoy elFinder locally or remotely over the internet.
Here are some suggestions:
Try to set root-dir to a folder containing the files you actually need, as minimal as possible, avoid exposing the entire file system.
For remote servers, use it via the Jupyter proxy such that the access will be protected by jupyter token or password. also, do not turn off the authentication in Jupyter.
For running it locally, we use allow-origin header (CORS) to protect access from a random website, for that to work, please use a modern browser and keep it updated.
Update ImJoy elFinder regularly with 'pip install -U imjoy-elfinder', in case there is security updates.
hupper
:hupper -m imjoy_elfinder
pip install -r requirements_dev.txt
You can also watch additional files by add -w
(e.g.: hupper -m imjoy_elfinder -w imjoy_elfinder/templates/elfinder/main.js
)
MIT
FAQs
An elfinder connector built with FastAPI, specifically for working with jupyter server proxy.
We found that imjoy-elfinder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.