Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Ease your way into static type checking by focusing on a small set of problems at a time.
It can be quite challenging to get an existing code base to pass mypy's checks, even at its most lenient settings, and unfortunately, until you do you can't use mypy as part of your CI/CD process.
mypy-runner
lets you gradually introduce type checking by identifying a subset of files and errors to check:
mypy-runner
adds the following features to mypy
:
typing
imports (see --add-missing-imports
below)mypy-runner
supports mypy
0.730 and higher.
::
usage: mypyrun [-h] [--version] [--daemon] [--select SELECT [SELECT ...]] [--ignore IGNORE [IGNORE ...]] [--warn WARN [WARN ...]] [--color] [--show-ignored] [--add-missing-imports] [--options OPTIONS] [--config-file CONFIG_FILE]
[--files FILES [FILES ...]] [--warning-filters WARNING_FILTERS [WARNING_FILTERS ...]] [--error-filters ERROR_FILTERS [ERROR_FILTERS ...]] [--mypy-executable MYPY_EXECUTABLE]
[ARG [ARG ...]]
positional arguments:
ARG Regular mypy flags and files (precede with --)
optional arguments:
-h, --help show this help message and exit
--version show program's version number and exit
--daemon Run mypy in daemon mode (inverse: --no-daemon)
--select SELECT [SELECT ...], -s SELECT [SELECT ...]
Errors to check
--ignore IGNORE [IGNORE ...], -i IGNORE [IGNORE ...]
Errors to skip
--warn WARN [WARN ...], -w WARN [WARN ...]
Errors to convert into warnings
--color Colorize output (inverse: --no-color)
--show-ignored, -x Show errors that have been ignored (darker if using color)
--add-missing-imports
Add missing typing imports. This will detect mypy errors related to missing classes from the typing module and automatically insert them into the file
--options OPTIONS, -o OPTIONS
Override the default options to use the namedconfiguration section (e.g. pass --options=foo to use the [mypyrun-foo] section)
--config-file CONFIG_FILE, -c CONFIG_FILE
Specific configuration file.
--files FILES [FILES ...]
Files to isolate (triggers use of 'active'options for these files)
--warning-filters WARNING_FILTERS [WARNING_FILTERS ...]
Regular expression to ignore messages flagged as warnings
--error-filters ERROR_FILTERS [ERROR_FILTERS ...]
Regular expression to ignore messages flagged as errors
--mypy-executable MYPY_EXECUTABLE
Path to the mypy executable
As with tools like flake8
, you use specific error codes to enable or disable error output.
Errors that are ignored or converted into warnings will not trigger a non-zero exit status.
mypyrun
looks for a [mypyrun]
section in either mypy.ini
or mypyrun.ini
.
Here's an example configuration file:
.. code-block:: ini
[mypyrun]
# run dmypy instead of mypy
daemon = true
# only display these errors
select =
not_defined,
return_expected,
return_not_expected,
incompatible_subclass_attr,
# all other errors are warnings
warn = *
# filter errors generated from these paths:
exclude =
thirdparty/*,
# pass these paths to mypy
paths =
arnold/python,
houdini/python,
katana/python,
mari/python,
maya/python,
nuke/python,
python/packages,
FAQs
Run mypy with options to filter errors and colorize output
We found that mypy-runner demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.