Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Static Python code analyzer, that tries to check if functions in code are pure or not and why.
Static Python code analyzer, that tries to check if functions in code are pure or not and why.
DISCLAIMER: this library is very experimental and has a lot of edge cases. Functions that mr. Proper marks as pure can be not pure, but they are usually cleaner than other functions.
pip install mr_proper
print
)
and blacklisted attributes access (like smth.count
);self
, class
or super
;This list is not enought to say that function is pure and some points are quite controversial, but it's a nice start.
Console usage:
# test.py
def add_one(n: int) -> int:
return n + 1
def print_amount_of_users(users_qs: QuerySet) -> None:
print(f'Current amount of users is {users_qs.count()}')
$ mr_propper test.py
add_one is pure!
print_amount_of_users is not pure because of:
it uses forbidden argument types (QuerySet)
it calls not pure functions (print)
it has no return
Usage inside Python code sample:
>>> import ast
>>> from mr_propper.utils import is_function_pure
>>> funcdef = ast.parse('''
def add_one(n: int) -> int:
return n + 1
''').body[0]
>>> is_function_pure(funcdef)
True
>>> is_function_pure(funcdef, with_errors=True)
(True, [])
CLI interface:
filepath
: path to .py file to check (directories are not supported for now);--recursive
: require inner calls to be pure for function pureness.getattr(sender, 'send_' + message_type)(message)
).We would love you to contribute to our project. It's simple:
Here are useful tips:
make check
.
Please do it before TravisCI does.FAQs
Static Python code analyzer, that tries to check if functions in code are pure or not and why.
We found that mr-proper demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.