Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A minimal blogging library.
The purpose of minumtium is to be embedded inside simple projects like landing pages or personal portfolio pages where it is not needed to have a lot of features. The objective is to:
It is not meant to provide a full-fledged blogging platform. Features like comments, profiles, view counters, social-network integrations and even configuration files are out of scope.
The idea behind minumtium is that it should do the bare minimum: provide you the code to create posts, as well as provide a way to control who can post. That's it:
It is just a library that creates and lists blog posts, you can add other features by using external libraries, like building lego (a very minimal lego, though).
Minumtium has been created so that it can be a library inside a bigger project. By default, it won't even provide you a UI or even REST API endpoints. The user should encapsulate minumtium inside its own code and integrate it inside its project. It is expected that you implement your own authentication adapters to allow it to integrate to your auth system and so on.
Being so bare minimal would mean that minumtium is almost useless, as it is quite simple to implement its core functionality. Minumtium has been built from ground up to be extensible with custom adapters and extension libraries. Those can:
Install it using pip, or you favorite venv manager:
# Using pip
pip install minumtium
# Using pipenv
pipenv install minumtium
# Using poetry
poetry install minumtium
Always interact with the service by providing its dependencies:
from modules.posts import PostRepository, PostService
from minumtium.infra.implementations.sqlalchemy_database import SqlAlchemyAdapter
db_adapter = SqlAlchemyAdapter({'engine': 'sqlite_memory'}, 'posts')
post_repository = PostRepository(db_adapter)
post_service = PostService(post_repository)
summary = post_service.get_latest_posts_summary(count=10)
You may not want to write a bunch of code, and for that reason you will very likely want to use plugins. Here are some of the standard plugins:
You can refer to their repositories for more information on how to use them.
There are two things you will want to integrate:
posts
service at minumtium.modules.posts.PostService
idm
service at minumtium.modules.idm.IdmService
Integrating those services mean you will need to inject a few dependencies into them:
posts
service depends on the PostRepository
.PostRepository
depends on a DatabaseAdapter
implementation.Having a dependency injection system definitely helps out. You can take a look at the FastAPI Plugin code that is very simple and shows how this integration can be done.
Adding support for other kinds of databases or authentication methods will consist on implementing the adapter interfaces:
minumtium.infra.database.adapter.DatabaseAdapter
minumtium.infra.authentication.adapter.AuthenticationAdapter
Those custom adapters are provided as dependencies when creating the services and the repositories.
Applications are the actual implementation of something usable. An example is the Fast API REST API application. Applications are supposed to provide you a way to actually use minumtium without having to reinvent the wheel.
Applications are provided as extension libraries, that will encapsulate minumtium something like FastAPI, for example. It is up to the user to register the minumtium client inside your main client so that you have all of its routes available.
You can create your own application and distribute it as a library. Those extension libraries are supposed to wrap minumtium into something else.
I have created this while working on my personal portfolio page. It was supposed to be much more minimal, like a single python file. As I started developing it I have decided to use it to practice both TDD and layered architectures. It is mostly a crud, so it was a good exercise and it is easy to read the source code.
Maybe it will not be so minimal as I wanted, but I learned some nice stuff along the way 😁.
FAQs
A very simple blogging library.
We found that minumtium demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.