Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This Python API can be used to control Numato USB GPIO expanders.
See the changelog for details on the releases.
Install pipx if you don't have it. It isolates your python tools' dependencies.
pip install pipx
pipx ensurepath # helps the shell to find the tools by adding ~/.local/bin to the path
Install latest development version:
pipx install git+https://github.com/clssn/numato-gpio.git
Or install latest release:
pipx install numato-gpio
Test whether your devices can be found running the command-line interface like
numato-discover
. Remember to have your user in the dialout
group,
since the devices are registered as /dev/ttyACMx (i.e. modem devices).
Expected output:
❯ python3 -m numato_gpio
dev: /dev/ttyACM0 | id: 0 | ver: 00000009 | ports: 32 | iodir: 0xffffffff | iomask: 0x00000000 | state: 0x00000000
dev: /dev/ttyACM1 | id: 1 | ver: 00000009 | ports: 32 | iodir: 0xffffffff | iomask: 0x00000000 | state: 0x00000000
The API can be used like:
import numato_gpio as gpio
# You can instantiate the device directly from its OS identifier, for instance
# "/dev/ttyACM0" on Linux or "COM5" on Windows.
dev = gpio.NumatoUsbGpio("/dev/ttyACM0")
# Alternatively, you can use the discovery function, but it is limited to
# Linux' /dev/ttyACM* devices. This is because discovery will open and try to
# interact with any device. This can lead to errors in unrelated devices.
# Under windows the naming scheme is entirely flat (COMx) increasing the error
# potential, so no discovery here.
# my_device_id = 0
# gpio.discover()
# dev = gpio.devices[my_device_id]
# Configure port 4 as output and set it to high
dev.setup(4, gpio.OUT)
dev.write(4, 1)
# Configure port 27 as input and print its logic level
dev.setup(27, gpio.IN)
print(dev.read(27))
# Configure port 2 as input and print its ADC value
dev.setup(2, gpio.IN)
print(dev.adc_read(2))
# Configure port 14 as input and setup notification on logic level changes
dev.setup(14, gpio.IN)
def callback(port, level):
print("{edge:7s} edge detected on port {port} "
"-> new logic level is {level}".format(
edge="Rising" if level else "Falling",
port=port,
level="high" if level else "low")
)
dev.add_event_detect(14, callback, gpio.BOTH)
dev.notify = True
See changelog.
In case your device can't be discovered or you even get an error message or stacktrace, please follow the troubleshooting guide.
Though the code works well in a Home Assistant integration since 2018, there are quite some aspects to improve. The following issues are only the ones the author is aware of:
/dev/ACMx
devices are scanned which were mapped on the author's LinuxIf you plan to make a contribution you should use poetry
to set-up your
development environment. So first make sure to install the tool if you don't
have it already.
pip install poetry
Then have poetry install the dependencies and the numato-project (editable) in a virtualenv.
poetry install
You can now activate the virtualenv (.venv directory) like
poetry shell
If you use VSCode or similar IDEs, ensure that their Python environment is configured to the .venv directory so their tools, like Debugger, Test Explorer etc., work.
Note that all commands of the Makefile are using poetry run
, so you don't have
to run poetry shell
before calling them.
Unit tests in the tests
directory are using a device mockup which mimicks
a Numato device's responses as far as known at the state of development.
System tests in the sys_tests
folder are meant to be run using a real device
and will just fail, if no device is connected. They are an important complement
to unit tests, because they are the real thing and might behave differently
than the mockup device for the unit tests.
If you consider to run system tests you should be aware that it may be dangerous running them.
WARNING
FAQs
Python API for Numato GPIO Expanders
We found that numato-gpio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.