Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The plugin-based framework of the Nextline backend API server
Table of Contents
Nextline is a DAQ sequencer of the Observatory Control System (OCS). Nextline allows line-by-line execution of concurrent Python scripts, which control telescopes, by multiple users simultaneously from web browsers.
Nextline consists of multiple packages. This package, nextline-graphql, provides the framework for the backend API server. It is a plugin-based framework. Features are added by plugins.
Please use the following DOI for the core package to cite Nextline in general unless you need to refer to a specific package.
The plugin system of nextline-graphql is apluggy.
These plugins are included in this package.
These plugins are not included in this package. They can be installed separately.
The front-end web app is currently in a single package. The development of a plugin-based system is planned.
The section shows how to run the Nextline backend API server. How to run the front-end web app is described elsewhere.
Docker images of the Nextline backend API server are created as ghcr.io/simonsobs/nextline-graphql. These images are created by the Dockerfile. No external plugins are included in the images.
Use, for example, the following command to run as a Docker container.
docker run -p 8080:8000 ghcr.io/simonsobs/nextline-graphql
If you access to the API server with a web browser, you will see the GraphQL IDE: http://localhost:8080/.
To include external plugins, you can create a new Docker image with ghcr.io/simonsobs/nextline-graphql as the base image. For example, nextline-rdb shows how to create a new Docker image with nextline-rdb as an external plugin.
You can create a virtual environment, install packages, and run the API server as follows.
python -m venv venv
source venv/bin/activate
pip install nextline-graphql
pip install uvicorn
uvicorn --lifespan on --factory --port 8080 nextlinegraphql:create_app
Check with a web browser at http://localhost:8080/.
If you check out external plugins, nextline-graphql automatically detects them as plugins. An example can be described in nextline-rdb.
nextline-graphql uses dynaconf for configuration management. nextline-graphql itself does not have any configuration except for logging. External plugins have configurations.
This section shows an example way to check out code from GitHub for development.
python -m venv venv
source venv/bin/activate
git clone git@github.com:simonsobs/nextline.git
git clone git@github.com:simonsobs/nextline-graphql.git
pip install -e ./nextline/"[tests,dev]"
pip install -e ./nextline-graphql/"[tests,dev]"
To run
uvicorn --port 8080 --lifespan on --factory --reload --reload-dir nextline-graphql --reload-dir nextline nextlinegraphql:create_app
FAQs
A GraphQL API for Nextline
We found that nextline-graphql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.