Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Python port of the fzy fuzzy string matching algorithm.
python >= 3.7
pip install pfzy
Full documentation: https://pfzy.readthedocs.io/
import asyncio
from pfzy import fuzzy_match
result = asyncio.run(fuzzy_match("ab", ["acb", "acbabc"]))
>>> print(result)
[{'value': 'acbabc', 'indices': [3, 4]}, {'value': 'acb', 'indices': [0, 2]}]
fuzzywuzzy is a famous python package for performing fuzzy matching between strings powered by python-Levenshtein. While it does its job well it doesn't calculate/provide the matching indices which is essential in a fuzzy finder applications.
The fzy fuzzy matching algorithm can calculate the matching score while also providing the matching indices which fuzzy finder applications can use to provide extra highlights.
The initial implementation of this algorithm can be found at sweep.py which is a python implementation of the terminal fuzzy finder. The code snippet is later used by the project vim-clap.
I found myself needing this logic across multiple projects hence decided to strip out the logic and publish a dedicated package with detailed documentation and unittest.
All 3 projects mentioned in Credit are all licensed under MIT.
This project is licensed under MIT. Copyright (c) 2021 Kevin Zhuang
FAQs
Python port of the fzy fuzzy string matching algorithm
We found that pfzy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.