
Security Fundamentals
Turtles, Clams, and Cyber Threat Actors: Shell Usage
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Importlab is a library for Python that automatically infers dependencies and calculates a dependency graph. It can perform dependency ordering of a set of files, including cycle detection.
Importlab's main use case is to work with static analysis tools that process one file at a time, ensuring that a file's dependencies are analysed before it is.
(This is not an official Google product.)
Apache 2.0
Importlab can be installed from pip
::
pip install importlab
To check out and install the latest source code
::
git clone https://github.com/google/importlab.git
cd importlab
python setup.py install
Importlab is primarily intended to be used as a library. It takes one or more python files as arguments, and generates an import graph, typically used to process files in dependency order.
It is currently integrated into
pytype <https://github.com/google/pytype>
__
Importlab ships with a small command-line tool, also called
importlab
, which can display some information about a project's
import graph.
::
usage: importlab [-h] [--tree] [--unresolved] [filename [filename ...]]
positional arguments:
filename input file(s)
optional arguments:
-h, --help show this help message and exit
--tree Display import tree.
--unresolved Display unresolved dependencies.
Makefile
generation, to take advantage of make
's incremental
update and parallel execution features
Integration with other static analysis tools
FAQs
A library to calculate python dependency graphs.
We found that importlab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security Fundamentals
The Socket Threat Research Team uncovers how threat actors weaponize shell techniques across npm, PyPI, and Go ecosystems to maintain persistence and exfiltrate data.
Security News
At VulnCon 2025, NIST scrapped its NVD consortium plans, admitted it can't keep up with CVEs, and outlined automation efforts amid a mounting backlog.
Product
We redesigned our GitHub PR comments to deliver clear, actionable security insights without adding noise to your workflow.