Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A Python API to control Lutron Caséta devices.
If you don't know the IP address of the bridge, the leap-scan
tool (requires the cli extra, pip install pylutron_caseta[cli]
) will search for LEAP devices on the local network and display their address and LEAP port number.
In order to communicate with the bridge device, you must complete the pairing process. This generates certificate files for authentication. pylutron_caseta can do this two ways.
If pylutron_caseta is installed with the cli extra (pip install pylutron_caseta[cli]
), the lap-pair
tool can be used to generate the certificate files. Simply running lap-pair <BRIDGE HOST>
(note the LEAP port number should not be included) will begin the pairing process. The certificate files will be saved in $XDG_CONFIG_HOME/pylutron_caseta
(normally ~/.config/pylutron_caseta
) in the files [BRIDGE HOST]-bridge.crt
, [BRIDGE HOST].crt
, [BRIDGE HOST].key
. Check lap-pair --help
if you want to use different files.
If pylutron_caseta is being integrated into a larger application, the pairing functionality can be reused to allow pairing from within that application.
async def pair(host: str):
def _ready():
print("Press the small black button on the back of the bridge.")
data = await async_pair(host, _ready)
with open("caseta-bridge.crt", "w") as cacert:
cacert.write(data["ca"])
with open("caseta.crt", "w") as cert:
cert.write(data["cert"])
with open("caseta.key", "w") as key:
key.write(data["key"])
print(f"Successfully paired with {data['version']}")
Once you have the certificate files, you can connect to the bridge and start controlling devices.
import asyncio
from pylutron_caseta.smartbridge import Smartbridge
async def example():
# `Smartbridge` provides an API for interacting with the Caséta bridge.
bridge = Smartbridge.create_tls(
"YOUR_BRIDGE_IP", "caseta.key", "caseta.crt", "caseta-bridge.crt"
)
await bridge.connect()
# Get the first light.
# The device is represented by a dict.
device = bridge.get_devices_by_domain("light")[0]
# Turn on the light.
# Methods that act on devices expect to be given the device id.
await bridge.turn_on(device["device_id"])
await bridge.close()
# Because pylutron_caseta uses asyncio,
# it must be run within the context of an asyncio event loop.
loop = asyncio.get_event_loop()
loop.run_until_complete(example())
For development and testing of new features, there is a leap
command in the cli extras (pip install pylutron_caseta[cli]
) which can be used for communicating directly with the bridge, similar to using curl
.
Getting information about the bridge:
$ leap 192.168.86.49/server | jq
{
"Servers": [
{
"href": "/server/1",
"Type": "LEAP",
"NetworkInterfaces": [
{
"href": "/networkinterface/1"
}
],
"EnableState": "Enabled",
"LEAPProperties": {
"PairingList": {
"href": "/server/leap/pairinglist"
}
},
"Endpoints": [
{
"Protocol": "TCP",
"Port": 8081,
"AssociatedNetworkInterfaces": null
}
]
}
]
}
Turning on the first dimmer:
$ ip=192.168.86.49
$ device=$(leap "${ip}/zone/status/expanded?where=Zone.ControlType:\"Dimmed\"" | jq -r '.ZoneExpandedStatuses[0].Zone.href')
$ leap -X CreateRequest "${ip}${device}/commandprocessor" -d '{"Command":{"CommandType":"GoToLevel","Parameter":[{"Type":"Level","Value":100}]}}'
FAQs
Provides an API to the Lutron Smartbridge
We found that pylutron-caseta demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.