Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
packed is a Python library that provides a simple way to serialize (pack) and deserialize (unpack) custom Python objects, leveraging the efficient MessagePack binary serialization format. It's designed to help you easily transmit objects over networks, save them to files, or perform any operation that requires converting objects to bytes and back.
@packable
decorator.__packed__
method.__unpacked__
class method to control how objects are reconstructed during unpacking.Install packed using pip
:
pip3 install packed
To make a custom class packable, decorate it with @packable
and define a __packed__
method that returns a dictionary of the attributes you want to serialize.
from packed import packable
@packable # Register the class for packing
class EqualMatcher:
def __init__(self, expected):
self._expected = expected
def match(self, actual):
return actual == self._expected
def __packed__(self): # Select the fields to pack
return {"expected": self._expected}
Use the pack
function to serialize an object into bytes.
Client Side:
from packed import pack
matcher = EqualMatcher("banana")
packed_data = pack(matcher)
# You can now send 'packed_data' over a network or save it to a file
Use the unpack
function to deserialize bytes back into an object.
Server Side:
from packed import unpack
# Assume 'packed_data' is received from a network or read from a file
matcher = unpack(packed_data)
assert matcher.match("banana") is True
packed supports serialization of the following standard Python data types:
int
, float
, bool
, None
, str
, bytes
[1, 2, 3]
(1, 2, 3)
{'key': 'value'}
{1, 2, 3}
@packable
decorator.These types are serialized using MessagePack's built-in support for these data types, ensuring efficient and reliable serialization.
Registration: When you decorate a class with @packable
, it gets registered with the internal resolver. This allows the packed
library to keep track of which classes can be packed and unpacked.
Packing:
__packed__
method you define in your class specifies what data gets serialized.pack
function uses this method to convert your object into a serializable form.Unpacking:
unpack
function reads the metadata and reconstructs the object.__unpacked__
class method, it will use that to create the object.If your class requires custom logic during unpacking, define a __unpacked__
class method.
@packable
class MyClass:
def __init__(self, value):
self.value = value
def __packed__(self):
return {'value': self.value}
@classmethod
def __unpacked__(cls, value):
# Custom logic during unpacking
instance = cls(value)
instance.setup_additional_state()
return instance
def setup_additional_state(self):
# Additional initialization
pass
You can register a class with a custom name by passing the name to the decorator. This is useful if you need to avoid name collisions or want to use a different identifier.
@packable("CustomName")
class MyClass:
# Class definition
If you have a class hierarchy, register each subclass separately if you intend to pack and unpack them.
@packable
class BaseClass:
# Base class definition
@packable
class SubClass(BaseClass):
# Subclass definition
MessagePack is an efficient binary serialization format. It lets you exchange data among multiple languages like JSON but it's faster and smaller.
By using MessagePack under the hood, packed provides:
packed uses umsgpack, a pure Python implementation of MessagePack, for serialization and deserialization. This ensures that the library is lightweight and has minimal dependencies, making it easy to install and integrate.
FAQs
Simple serialization and deserialization of custom Python objects using MessagePack
We found that packed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.