
Research
Malicious Go “crypto” Module Steals Passwords and Deploys Rekoobe Backdoor
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.
packtivity
Advanced tools
This package aims to collect implementations of both synchronous and asynchronous execution of preserved, but parametrized scientific computational tasks that come with batteries included, i.e. with a full specification of their software dependencies. In that sense they are packaged activities -- packtivities.
This package provides tools to validate and execute data processing tasks that are written according to the "packtivity" JSON schemas defined in yadage-schemas.
Packtivities define
At run-time they are paired with a concrete set of parameters supplied as JSON documents and and external storage/state to actually execute these tasks.
This package is used by yadage to execute the individual steps of yadage workflows.
This packtivity spec is part of a number of yadage workflow and runs the Delphes detector simulation on a HepMC file and outputs events in the LHCO and ROOT file formats. This packtivity is stored in a public location from which it can be later retrieved:
process:
process_type: 'string-interpolated-cmd'
cmd: 'DelphesHepMC {delphes_card} {outputroot} {inputhepmc} && root2lhco {outputroot} {outputlhco}'
publisher:
publisher_type: 'frompar-pub'
outputmap:
lhcofile: outputlhco
rootfile: outputroot
environment:
environment_type: 'docker-encapsulated'
image: lukasheinrich/root-delphes
You can run the packtivity in a synchronous way by specifying the spec (can point to GitHub), all necessary parameters and attaching an external state (via the --read and --write flags).
packtivity-run -t from-github/phenochain delphes.yml \
-p inputhepmc="$PWD/pythia/output.hepmc" \
-p outputroot="'{workdir}/output.root'" \
-p outputlhco="'{workdir}/output.lhco'" \
-p delphes_card=delphes/cards/delphes_card_ATLAS.tcl \
--read pythia --write outdir
In order to facilitate usage of distributed resources, a number of Asynchronous backends can be specified. Here is an example for IPython Parallel clusters
packtivity-run -b ipcluster --asyncwait \
-t from-github/phenochain delphes.yml \
-p inputhepmc="$PWD/pythia/output.hepmc" \
-p outputroot="'{workdir}/output.root'" \
-p outputlhco="'{workdir}/output.lhco'" \
-p delphes_card=delphes/cards/delphes_card_ATLAS.tcl \
--read pythia --write outdir
You can replacing the --asyncwait with --async flag in order to get a JSONable proxy representation with which to later on check on the job status. By default the proxy information is written to proxy.json (customizable via the -x flag):
packtivity-run -b celery --async \
-t from-github/phenochain delphes.yml \
-p inputhepmc="$PWD/pythia/output.hepmc" \
-p outputroot="'{workdir}/output.root'" \
-p outputlhco="'{workdir}/output.lhco'" \
-p delphes_card=delphes/cards/delphes_card_ATLAS.tcl \
--read pythia --write outdir
And at a later point in time you can check via:
packtivity-checkproxy proxy.json
Users can implement their own backends to handle the JSON documents describing the packtivities. It can be enabled
by using the fromenv backend and setting an environment variable specifying the module holding the backend and proxy
classes. The format of the environment variable is module:backendclass:proxyclass. E.g.:
export PACKTIVITY_ASYNCBACKEND="externalbackend:ExternalBackend:ExternalProxy"
FAQs
packtivity - general purpose schema + bindings for PROV activities
We found that packtivity demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An impersonated golang.org/x/crypto clone exfiltrates passwords, executes a remote shell stager, and delivers a Rekoobe backdoor on Linux.

Security News
npm rolls out a package release cooldown and scalable trusted publishing updates as ecosystem adoption of install safeguards grows.

Security News
AI agents are writing more code than ever, and that's creating new supply chain risks. Feross joins the Risky Business Podcast to break down what that means for open source security.