
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
In what follows python is an alias for python3.10
or any later version (python3.11 and so on).
Install the latest pip & setuptools packages versions
python -m pip install --upgrade pip setuptools
Download and install the latest stable version from PyPI repository
python -m pip install --upgrade paradigm
Download the latest version from GitHub repository
git clone https://github.com/lycantropos/paradigm.git
cd paradigm
Install dependencies
python -m pip install -r requirements.txt
Install
python setup.py install
With setup
>>> import typing
>>> from paradigm.base import (
... OptionalParameter,
... ParameterKind,
... PlainSignature,
... RequiredParameter,
... signature_from_callable,
... )
>>> from typing_extensions import Self
>>> class UpperOut:
... def __init__(self, outfile: typing.IO[typing.AnyStr]) -> None:
... self._outfile = outfile
... def write(self, s: typing.AnyStr) -> None:
... self._outfile.write(s.upper())
... def __getattr__(self, name: str) -> typing.Any:
... return getattr(self._outfile, name)
...
>>> def func(
... foo: int, /, bar: float, *, baz: bool = False, **kwargs: str
... ) -> None:
... pass
...
we can obtain a signature of
>>> signature_from_callable(func) == PlainSignature(
... RequiredParameter(
... annotation=int,
... kind=ParameterKind.POSITIONAL_ONLY,
... name='foo',
... ),
... RequiredParameter(
... annotation=float,
... kind=ParameterKind.POSITIONAL_OR_KEYWORD,
... name='bar',
... ),
... OptionalParameter(
... annotation=bool,
... default=False,
... kind=ParameterKind.KEYWORD_ONLY,
... name='baz',
... ),
... OptionalParameter(
... annotation=str,
... kind=ParameterKind.VARIADIC_KEYWORD,
... name='kwargs',
... ),
... returns=None,
... )
True
>>> signature_from_callable(UpperOut) == PlainSignature(
... RequiredParameter(
... annotation=typing.IO[typing.AnyStr],
... kind=ParameterKind.POSITIONAL_OR_KEYWORD,
... name='outfile',
... ),
... returns=Self,
... )
True
>>> signature_from_callable(UpperOut.write) == PlainSignature(
... RequiredParameter(
... annotation=typing.Any,
... kind=ParameterKind.POSITIONAL_OR_KEYWORD,
... name='self',
... ),
... RequiredParameter(
... annotation=typing.AnyStr,
... kind=ParameterKind.POSITIONAL_OR_KEYWORD,
... name='s',
... ),
... returns=None,
... )
True
>>> signature_from_callable(any) == PlainSignature(
... RequiredParameter(
... annotation=typing.Iterable[object],
... kind=ParameterKind.POSITIONAL_ONLY,
... name='iterable',
... ),
... returns=bool,
... )
True
>>> signature_from_callable(bool) == PlainSignature(
... OptionalParameter(
... annotation=object,
... kind=ParameterKind.POSITIONAL_ONLY,
... name='o',
... ),
... returns=Self,
... )
True
>>> signature_from_callable(float.hex) == PlainSignature(
... RequiredParameter(
... annotation=Self,
... kind=ParameterKind.POSITIONAL_ONLY,
... name='self',
... ),
... returns=str,
... )
True
Install bump-my-version.
Choose which version number category to bump following semver specification.
Test bumping version
bump-my-version bump --dry-run --verbose $CATEGORY
where $CATEGORY is the target version number category name, possible
values are patch/minor/major.
Bump version
bump-my-version bump --verbose $CATEGORY
This will set version to major.minor.patch-alpha.
Test bumping version
bump-my-version bump --dry-run --verbose release
Bump version
bump-my-version bump --verbose release
This will set version to major.minor.patch.
Install dependencies
python -m pip install -r requirements-tests.txt
Plain
pytest
Inside Docker container:
CPython
docker-compose --file docker-compose.cpython.yml up
PyPy
docker-compose --file docker-compose.pypy.yml up
Bash script (e.g. can be used in Git hooks):
with CPython
./run-tests.sh
or
./run-tests.sh cpython
with PyPy
./run-tests.sh pypy
PowerShell script (e.g. can be used in Git hooks):
CPython
.\run-tests.ps1
or
.\run-tests.ps1 cpython
PyPy
.\run-tests.ps1 pypy
FAQs
Python objects metadata parser.
We found that paradigm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.