Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Python wrapper for the lakers
crate.
pip install lakers-python
import lakers
# generate a keypair
lakers.p256_generate_key_pair()
# instantiate a initiator and prepare EDHOC's message 1
initiator = lakers.EdhocInitiator()
message_1 = initiator.prepare_message_1(c_i=None, ead_1=None)
# for more examples, see the tests in the repository
To show logs emitted by the wrapped Rust implementation, set the RUST_LOG
variable, e.g.:
RUST_LOG=trace python -c "import lakers"
To build and test:
maturin develop
pytest
To deploy:
# need to make the examples folder available for the python package,
# because it is listed as one of the workspace's default-members
ln -s ../examples ./examples
MATURIN_PYPI_TOKEN=<your pypi token here> maturin publish
The maturin executable must be available. The recommended way is to install and use it in a virtual environment:
python3 -m venv .venv
source .venv/bin/activate
pip install -U pip maturin pytest cbor2
pip freeze
FAQs
Unknown package
We found that lakers-python demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.