
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
pycookiecheat
Advanced tools
Borrow cookies from your browser's authenticated session for use in Python scripts.
Borrow cookies from your browser's authenticated session for use in Python scripts.
NB: Use pip and python instead of pip3 and python3 if you're still
on Python 2 and using pycookiecheat < v0.4.0. pycookiecheat >= v0.4.0 requires
Python 3 and in general will aim to support python versions that are stable and
not yet end-of-life: https://devguide.python.org/versions.
python3 -m pip install pycookiecheatSee #12. Chrome is now
using a few different keyrings to store your Chrome Safe Storage password,
instead of a hard-coded password. Pycookiecheat doesn't work with most of these
so far, and to be honest my enthusiasm for adding support for ones I don't use
is limited. However, users have contributed code that seems to work with some
of the recent Ubuntu desktops. To get it working, you may have to sudo apt-get install libsecret-1-dev python-gi python3-gi, and if you're installing into a
virtualenv (highly recommended), you need to use the --system-site-packages
flag to get access to the necessary libraries.
Alternatively, some users have suggested running Chrome with the
--password-store=basic or --use-mock-keychain flags.
git clone https://github.com/n8henrie/pycookiecheat.gitcd pycookiecheatpython3 -m venv .venv./.venv/bin/python -m pip install -e .[dev]After installation, the CLI tool can be run as a python module python -m or
with a standalone console script:
$ python -m pycookiecheat --help
usage: pycookiecheat [-h] [-b BROWSER] [-o OUTPUT_FILE] [-v] [-c COOKIE_FILE]
[-V]
url
Copy cookies from Chrome or Firefox and output as json
positional arguments:
url
options:
-h, --help show this help message and exit
-b BROWSER, --browser BROWSER
-o OUTPUT_FILE, --output-file OUTPUT_FILE
Output to this file in netscape cookie file format
-v, --verbose Increase logging verbosity (may repeat), default is
`logging.ERROR`
-c COOKIE_FILE, --cookie-file COOKIE_FILE
Cookie file
-V, --version show program's version number and exit
By default it prints the cookies to stdout as JSON but can also output a file in Netscape Cookie File Format.
from pycookiecheat import BrowserType, get_cookies
import requests
url = 'https://n8henrie.com'
# Uses Chrome's default cookies filepath by default
cookies = get_cookies(url)
r = requests.get(url, cookies=cookies)
# Using an alternate browser
cookies = get_cookies(url, browser=BrowserType.CHROMIUM)
Use the cookie_file keyword-argument to specify a different path to the file
containing your cookies:
get_cookies(url, cookie_file='/abspath/to/cookies')
You may be able to retrieve cookies for alternative Chromium-based browsers by
manually specifying something like
"/home/username/.config/BrowserName/Default/Cookies" as your cookie_file.
I don't use Windows or have a PC, so I won't be adding support myself. Feel free to make a PR :)
cryptography module on OS X(pycookiecheat <v0.4.0)
If you're getting this
error
and using Homebrew, then you need to follow the instructions for Building
cryptography on OS
X
and export LDFLAGS="-L$(brew --prefix openssl)/lib" CFLAGS="-I$(brew --prefix openssl)/include" and try again.
cryptography module on LinuxPlease check the official cryptography docs. On some systems (e.g. Ubuntu), you
may need to do something like sudo apt-get install build-essential libssl-dev libffi-dev python-dev prior to installing with pip.
On KDE, Chrome defaults to using KDE's own keyring, KWallet. For pycookiecheat to support KWallet the dbus-python package must be installed.
python -m pip install git+https://github.com/n8henrie/pycookiecheat@masterurl is now a positional argument (no longer requires -u)BrowserType enum; string
is no longer supportedhttps:// if the scheme is not specified--version flag (thanks @samiam)-c flag to specify custom path to cookie file (thanks @samiam)browser argument into a BrowserType at parse timeget_cookies function that can be used for all supported
browsers
chrome_cookies or firefox_cookies
functions, but will leave these around for backwards compatibilityruff instead of hodgepodge of flake8 / pycodestyle / black and
othersBrowserType enum
BrowserType (e.g. BrowserType.CHROME)as_cookies parameter to allow returning list[Cookie] instead of
dict (without breaking backward compatibility)Cookies databasecryptography back to PyCrypto and hashlib for easier
installation.cryptography instead of
pycrypto (thanks to Taik!)
FAQs
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.