Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A simple pytest plugin to disable network on socket level.
$ pip install pytest-network
pytest-network
has a flag --disable-network
that will raise an error
if tests will try to use socket.socket.connect
You can use it directly like:
$ python3 -m pytest --disable-network
or add this flag as the default behavior in your pytest.ini
:
[pytest]
addopts = --disable-network
Also you can directly disable network:
import requests
def test_network_request_raises_error(disable_network):
response = requests.get('https://github.com') # this will raise an exception
assert response.status_code == 200
or directly enable (if you have default --disable-network
flag):
import requests
def test_network_request_is_ok(disable_network):
response = requests.get('https://github.com')
assert response.status_code == 200 # this will pass
To setup development environment you must first create a virtual environment. For example:
$ python3.8 -m venv <venv-name>
After that install all requirements:
$ pip install -r requirements.txt
And install plugin itself (inside project directory and virtual environment):
$ pip install -e .
Check that tests are running:
$ make test
We would love you to contribute to our project. It's simple:
Here are useful tips:
FAQs
A simple plugin to disable network on socket level.
We found that pytest-network demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.