Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The intellisense and code linting that is so prevalent in modern editors, does not work out-of-the-gate for MicroPython projects. While the language is Python, the modules used are different from CPython , and also different ports have different modules and classes , or the same class with different parameters.
Writing MicroPython code in a modern editor should not need to involve keeping a browser open to check for the exact parameters to read a sensor, light-up a led or send a network request.
Fortunately with some additional configuration and data, it is possible to make the editors understand your flavor of MicroPython, wether you use one of the pre-compiled firmwares, but also if you run a one-off custom firmware version.
]
In order to achieve this a few things are needed:
Please review the documentation on [https://micropython-stubber.readthedocs.io]
With that in place, VSCode will understand MicroPython for the most part, and help you to write code, and catch more errors before deploying it to your board.
Note that the above is not limited to VSCode and pylint, but it happens to be the combination that I use.
A lot of subs have already been generated and are shared on PyPi, github or pre-installed by a tool, so it is quite likely that you can just grab a copy be be productive in a few minutes.
This section describes how to install the stubs from PyPI, and how to use them in your project. If you want to create or maintain stub - please see the next section.
pip install -U micropython-<port>[-<board>]stubs --no-user --target ./typings
pip install -U micropython-<port>[-<board>]stubs --no-user
Examples:
pip install -U micropython-stm32-stubs
# Install stubs for a specific version.
pip install -U micropython-esp32-stubs==1.20.0.*
# Install stubs for a specific board.
pip install -U micropython-rp2-pico_w-stubs
For more details how to use the stubs please refer to the documentation on RTD
The sister-repo MicroPython-stubs contains all stubs I have collected with the help of others, and which can be used directly. That repo also contains examples configuration files that can be easily adopted to your setup.
A second repo micropy-stubs repo maintained by BradenM, also contains stubs, but in a structure only used and distributed by the micropy-cli tool. You should use micropy-cli to consume stubs from that repo.
The (stretch) goal is to create a VSCode add-in to simplify the configuration, and allow easy switching between different firmwares and versions.
pip install micropython-stubber
# go to your working folder
cd my_stub_folder
mkdir all-stubs
# clone the micropython repo's and switch to a specific version
stubber clone --add-stubs
stubber switch v1.22.2
# get the document stubs for the current version ( v1.18 )
stubber get-docstubs
# get the frozen stubs for the current version ( v1.18 )
stubber get-frozen
# get the core CPython compatibility stubs from PyPi
stubber get-core
# Update the fallback stubs
stubber update-fallback
#
ls all-stubs
dir all-stubs
This is described in more detail in the developing and testing documents in the docs folder.
The name of the default branch has been changed to main
.
If you have cloned this repo before you main need to adjust the local repro to be aware of this, or create a fresh clone.
To update run the below command:
git branch -m master main
git fetch origin
git branch -u origin/main main
git remote set-head origin -a
for more info see Renaming a branch
Both MicroPython-Stubber
and mpflash
are licensed under the MIT license, and all contributions should follow this LICENSE.
This project follows the all-contributors specification. Contributions of any kind welcome!
FAQs
Tooling to create and maintain stubs for MicroPython
We found that micropython-stubber demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.