Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
pem is a Python module for parsing and splitting of PEM files, i.e. Base64-encoded DER keys and certificates.
It has no dependencies and does not attempt to interpret the certificate data in any way.
It’s born from the need to load keys, certificates, trust chains, and Diffie–Hellman parameters from various certificate deployments: some servers (like Apache) expect them to be a separate file, others (like nginx) expect them concatenated to the server certificate and finally some (like HAProxy) expect key, certificate, and chain to be in one file. With pem, your Python application can cope with all of those scenarios:
>>> import pem
>>> certs = pem.parse_file("chain.pem")
>>> certs
[<Certificate(PEM string with SHA-1 digest '...')>, <Certificate(PEM string with SHA-1 digest '...')>]
>>> str(certs[0])
'-----BEGIN CERTIFICATE-----\n...'
Additionally to the vanilla parsing code, pem also contains helpers for Twisted that save a lot of boilerplate code.
pem is written and maintained by Hynek Schlawack.
The development is kindly supported by my employer Variomedia AG and all my amazing GitHub Sponsors.
Available as part of the Tidelift Subscription.
The maintainers of pem and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source packages you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact packages you use. Learn more.
pem.OpenPGPPublicKey
and pem.OpenPGPPrivateKey
.
#72meta_headers
property.
#75pem.parse_file()
now accepts also pathlib.Path
objects.pem.parse()
now also accepts str
.text_payload
, bytes_payload
and decoded_payload
properties to all PEM objects that allow to directly access the payload without the envelope and possible headers.
#74FAQs
PEM file parsing in Python.
We found that pem demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.