Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Concise layer on top of subprocess, similar to sh project
If you see an error along the lines of:
ImportError: cannot import name 'zyx' from 'lagoon'
This means the app requires command zyx
to be available, and you don't have it on your system.
The solution is to install zyx
in the usual way, e.g. via your package manager.
Using OverlayFS create a merged view of the given (read only) dirs plus a (writable) temporary dir, print its path, and stay running until stdin is closed. The first given directory is the lowest in the pile (this is unlike the lowerdir mount option). This program requires root and is designed to be invoked via sudo.
Accept normal outcomes.
Accept abrupt outcomes.
Accept all outcomes.
Do not accept any outcome.
class ExpensiveTask()
Arbitrary task accelerated by Docker cache.
def __init__(context, discriminator, task)
Create a task keyed by context directory and discriminator string.
def run(force=NEVER, cache=NORMAL)
Run the task, where force
can be used to ignore a cached outcome, and cache
can be used to deny caching an outcome.
class ContextStream()
Fully customisable docker build context.
@classmethod
@contextmanager
def open(cls, dockerstdin)
Attach to the given stdin of docker build, which should have been given -
as context.
def put(name, path)
Add the given path as the given archive name.
def putstream(name, stream)
Add the given stream as the given archive name.
def mkdir(name)
Create a directory in the context.
@contextmanager
def iidfile()
Context manager yielding an object with args
to pass to docker build, and a read
function to get the image ID.
Text mode instances of Program for every executable, with dash translated to underscore e.g. from lagoon import pkg_config
for pkg-config
.
Like lagoon module but Program objects are in binary mode.
class Program()
Normally import an instance from lagoon
or lagoon.binary
module instead of instantiating manually.
@classmethod
def text(cls, path)
Return text mode Program for the executable at the given path.
@classmethod
def binary(cls, path)
Return binary mode Program for executable at given path.
def __getattr__(name)
Add argument, where underscore means dash.
def __getitem__(key)
Apply a style, e.g. partial
to suppress execution or print
to send stdout to console.
def __call__(*args, **kwargs)
Run program in foreground with additional args. Accepts many subprocess kwargs. Use partial
style to suppress execution, e.g. before running in background. Otherwise return CompletedProcess, or one of its fields if the rest are redirected, or None if all fields redirected.
def __enter__()
Start program in background yielding the Popen object, or one of its fields if the rest are redirected.
@singleton
class NOEOL()
Style to strip trailing newlines from stdout, in the same way as shell does.
def ONELINE(text)
Style to assert exactly one line of output, using splitlines
.
def unmangle(name)
Undo name mangling.
@contextmanager
def atomic(path)
Context manager yielding a temporary Path for atomic write to the given path. Parent directories are created automatically. Also suitable for making a symlink atomically. Leaves the given path unchanged if an exception happens.
class threadlocalproperty()
Like property
but each thread has its own per-object values.
def __init__(defaultfactory)
The defaultfactory
should return the initial value per object (per thread).
@contextmanager
def onerror(f)
Context manager that runs the given function if an exception happens, like finally
excluding the happy path.
@contextmanager
def mapcm(f, obj)
Invoke obj
as a context manager, apply f
to its yielded value, and yield that. For example apply Path
to the string yielded by TemporaryDirectory()
.
def stripansi(text)
Remove ANSI control sequences from the given text, to make it black and white.
class HarnessCase(TestCase)
Enter context managers in setUp and exit them in tearDown.
def harness()
Must yield exactly once.
GNU Screen interface, smoothing over its many gotchas.
def stuffablescreen(doublequotekey)
Return text mode Program for screen, with the given environment variable set to double quote.
class Stuff()
def __init__(session, window, doublequotekey)
Target the given screen session and window, using the given environment variable for double quote.
def __call__(text)
Send the given text so that it is received literally.
def eof()
Send EOF, may have no effect if not at the start of a line.
FAQs
Concise layer on top of subprocess, similar to sh project
We found that lagoon demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.