Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A batteries included task runner that works well with poetry.
✅ Straight forward declaration of project tasks in your pyproject.toml (or poe_tasks.toml)
✅ Tasks are run in poetry's virtualenv (or another env you specify)
✅ Shell completion of task names (and global options too for zsh)
✅ The poe CLI can be used standalone, or as a plugin for poetry
✅ Tasks can be commands, shell scripts, python expressions, or references to python functions
✅ Concise commands with extra arguments passed to the task poe [options] task [task_args]
✅ Easily define CLI arguments for your tasks
✅ Tasks can specify and reference environment variables, even without a shell
✅ Tasks are self documenting, with optional help messages (just run poe
with no arguments)
✅ Works with .env
files
✅ Can be used as a library to embed in other tools
✅ Also works fine without poetry
pipx install poethepoet
[tool.poe.tasks]
test = "pytest --cov=my_app" # a simple command task
serve.script = "my_app.service:run(debug=True)" # python script based task
tunnel.shell = "ssh -N -L 0.0.0.0:8080:$PROD:8080 $PROD &" # (posix) shell based task
$ poe test -v tests/unit # extra CLI arguments are appended to the underlying command
Poe => pytest --cov=my_app
...
If you're using poetry, then poe will automatically use CLI tools and libraries from your poetry managed virtualenv without you having to run poetry run
or poetry shell
Poe can also be used without poetry.
There's plenty to do, come say hi in the discussions or open an issue! 👋
Also check out the CONTRIBUTING guide 🤓
FAQs
A task runner that works well with poetry.
We found that poethepoet demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.