
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
Search, filter, inspect, download posts from Danbooru/Safebooru and find them back from the command line without setting up any service or database.
Suitable for daily terminal usage, usable for scripts and as a library for Python 3.6+.
See also lunasync to automatically download and keep in sync particular tags using lunafind, similar to Danbooru tag subscriptions or saved searches.
The first time a local post search is done, an index file to speed up future searches will be automatically created and updated when new post directories exist or are removed.
Test with ~165 000 posts
AMD FX-8300 (8 cores, 3.3GHz), TOSHIBA DT01ACA2 7200 RPM HDD,
BTRFS file system, Void Linux 4.18.14 x86_64:
--random or
--order is used.Test with ~60 000 posts
Celeron B815 (2 cores, 1.60GHz), 5400 RPM HDD, BTRFS file system,
Void Linux 4.18.20 x86_64:
Downloading to the current folder every post tagged blonde and 2girls (default booru is https://danbooru.donmai.us):
lunafind "blonde 2girls" --limit 200 --pages all --download .
Searching through the posts we just downloaded, printing image paths for the results:
lunafind "blonde blue_eyes rating:s score:>5" --source . --show-location media
See lunafind --help for all options and examples.
No real documentation yet. Three main classes are provided:
Post: represents a local or remote single post, with its info, media, notes
and artcom (artist commentary).
Album: works like a dictionary of Post, where keys are the post IDs.
Has magic methods and operators to facilitate working with them.
Can be filtered, ordered, downloaded, and more.
Stream: an efficiant lazy iterator yielding posts.
Can be filtered and multithread-downloaded.
Reproducing the command line examples in the section above:
from lunafind import Stream
Stream("blonde 2girls", limit=200, pages="all").download()
for post in Stream("blonde blue_eyes rating:s score:>5", client="."):
print(post.get_location("media"))
Requires Python 3.6+ and pip (for automatic easy install).
Tested on GNU/Linux and Windows 7, probably works on OSX and other POSIX
systems.
As root:
pip3 install -U lunafind
FAQs
Search, filter, inspect, download posts from Danbooru and local folders.
We found that lunafind demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.