Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Create a minimal virtual environment (and utility code around environments).
The key purpose of this module is for when the venv
module has been removed from the standard library by your Python distribution. Because venv
is not available on PyPI and is developed in the stdlib, it is not possible to install it using pip
or simply copy the code and expect it to work with older versions of Python. This module then attempts to be that portable alternative for creating virtual environments.
In general, though, using the venv
module should be preferred and this module used as a fallback.
There is also utility code around virtual environments. See the docs for details.
NOTE: The CLI is not available on Windows.
python -m microvenv [--without-scm-ignore-files] [env_dir=".venv"]
If an argument is provided to the script, it is used as the path to create the virtual environment in. Otherwise, the virtual environment is created in .venv
.
For programmatic usage, there is the create()
function, which is analogous to the venv.create()
function.
def create(env_dir: os.PathLike[str] | str = ".venv", *, scm_ignore_files={"git"}) -> None
The microvenv/_create.py
file is also small enough to have its contents passed in via the -c
flag to python
.
venv
moduleThe code operates similarly to py -m venv --symlinks --without-pip .venv
,
except that:
python
in the virtual environment directly)FAQs
A minimal re-implementation of Python's venv module plus utilities
We found that microvenv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.