
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
[!IMPORTANT]
New Version is Available
Check out Pyrefly, our next-generation Python typechecker and language server.
Pyre is a performant type checker for Python compliant with PEP 484. Pyre can analyze codebases with millions of lines of code incrementally – providing instantaneous feedback to developers as they write code. You can try it out on examples in the Pyre Playground.
Pyre ships with Pysa, a security focused static analysis tool we've built on top of Pyre that reasons about data flows in Python applications. Please refer to our documentation to get started with our security analysis.
Pysa is also available on the GitHub Marketplace as a Github Action
To get started, you need Python 3.8 or later and watchman working on your system. On MacOS you can get everything with homebrew:
$ brew install python3 watchman
On Ubuntu, Mint, or Debian; use apt-get
and homebrew:
$ sudo apt-get install python3 python3-pip python3-venv
$ brew install watchman
We tested Pyre on Ubuntu 18.04.5 LTS, CentOS 7, as well as OSX 10.11 and later.
We start by creating an empty project directory and setting up a virtual environment:
$ mkdir my_project && cd my_project
$ python3 -m venv ~/.venvs/venv
$ source ~/.venvs/venv/bin/activate
(venv) $ pip install pyre-check
Next, we teach Pyre about our new project:
(venv) $ pyre init
This command will set up a configuration for Pyre (.pyre_configuration
) as well as watchman (.watchmanconfig
) in your project's directory. Accept the defaults for now – you can change them later if necessary.
We are now ready to run Pyre:
(venv) $ echo "i: int = 'string'" > test.py
(venv) $ pyre
ƛ Found 1 type error!
test.py:1:0 Incompatible variable type [9]: i is declared to have type `int` but is used as type `str`.
This first invocation will start a daemon listening for filesystem changes – type checking your project incrementally as you make edits to the code. You will notice that subsequent invocations of pyre
will be faster than the first one.
For more detailed documentation, see https://pyre-check.org.
See CONTRIBUTING.md for how to help out.
Pyre is licensed under the MIT license.
FAQs
A performant type checker for Python
We found that pyre-check demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 17 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.