Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
parameter-expansion-patched
Advanced tools
Shell parameter expansion in Python. Patched by co-maintainer for a PyPI release.
This is an experimental Python library to enable POSIX parameter expansion in a string. It supports also a subset of Bash parameter expansion.
Note that this is a fork from upstream to support proper release on PyPI.
This repo https://github.com/nexB/parameter_expansion_patched is released at https://pypi.org/project/parameter-expansion-patched/ on PyPI.
Upstream is less active lately at https://github.com/kojiromike/parameter-expansion/
One reason is that it may be security risk. Another reason is to support lightweight analysis or evaluation of shell parameters with few system dependencies and outside of a running shell.
For instance this use in scancode-toolkit as part of a lightweight shell script parser to extract and expand parameters found in some build scripts.
All the standard shell expansions are supported, including some level of nested expansion, as long as this is not too complex or ambiguous. In addition, we support Bash substrings and string replacement. There is an extensive test suite listing all supported substitions
The expand()
function accepts a string and a dictionary of variables
(otherwise it uses the current environmnent variables). The string is
parsed with a custom parser and interpreted to perform the various
expansion procedures using these variables.
>>> from parameter_expansion import expand
>>> foo = 'abc/123-def.ghi'
>>> # Bland Expansion
>>> expand('abc $foo abc')
'abc abc/123-def.ghi abc'
>>> expand('abc${foo}abc')
'abcabc/123-def.ghiabc'
>>>
>>> # Default Value Expansion
>>> expand('-${foo:-bar}-')
'-abc/123-def.ghi-'
>>> expand('-${bar:-bar}-')
'-bar-'
>>> foo = 'abc/123-def.ghi'
>>> expand('abc $foo abc')
'abc abc/123-def.ghi abc'
>>> expand('abc${foo}abc')
'abcabc/123-def.ghiabc'
https://github.com/sayanarijit/expandvars has similar features yet does not cover all the expansions that this library supports (such as %, # and nested variables).
FAQs
Shell parameter expansion in Python. Patched by co-maintainer for a PyPI release.
We found that parameter-expansion-patched demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.