Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A python implementation of the ABC Software metric:
The ABC software metric was introduced by Jerry Fitzpatrick in 1997 to overcome the drawbacks of the LOC. The metric defines an ABC score as a triplet of values that represent the size of a set of source code statements. An ABC score is calculated by counting the number of assignments (A), number of branches (B), and number of conditionals (C) in a program. ABC score can be applied to individual methods, functions, classes, modules or files within a program.
Fitzpatrick's original paper is, at the time of writing, only available via the Wayback Machine, so a copy of it is included in this repo as well.
The paper lists the counting rules for C, C++ and Java, so here are the rules this repo uses for Python:
else
, elif
, except
.assert
statement without a conditional operator.Install the requirements in your virtual environment of choice, then you can see the command line arguments that are available:
$ python -m python_abc --help
usage: python_abc [-h] [--debug DEBUG] [--sort SORT] [--verbose VERBOSE] path
A python implementation of the ABC Software metric: https://en.wikipedia.org/wiki/ABC_Software_Metric
positional arguments:
path path to directory or file
optional arguments:
-h, --help show this help message and exit
--debug DEBUG display AST output for each element in the parsed tree
--sort SORT sort files from highest to lowest magnitude
--verbose VERBOSE display marked-up file
Given file.py
that contains the following text:
if a and b:
print(a)
else:
print(b)
a = sum(i for i in range(1000) if i % 3 == 0 and i % 5 == 0)
def f(n):
def inner(n):
return n ** 2
if n == 0:
return 1
elif n == 1:
return n
elif n < 5:
return (n - 1) ** 2
return n * pow(inner(n), f(n - 1), n - 3)
You can get the barebones output as follows:
$ python -m python_abc /path/to/file.py
/path/to/file.py <1, 7, 10> (12.2)
Passing the verbose
flag will give more detail:
$ python -m python_abc file.py --verbose=true
cc | if a and b:
b | print(a)
c | else:
b | print(b)
|
abbcc | a = sum(i for i in range(1000) if i % 3 == 0 and i % 5 == 0)
|
| def f(n):
| def inner(n):
| return n ** 2
c | if n == 0:
| return 1
cc | elif n == 1:
| return n
cc | elif n < 5:
| return (n - 1) ** 2
bbb | return n * pow(inner(n), f(n - 1), n - 3)
file.py <1, 7, 10> (12.2)
If you want to inspect the abstract syntax tree for the file you can pass the debug
flag, which
will print out each node from the tree and the vector that resulted from it.
The path
argument can also be a path to a directory, in which case all Python files in that
directory (and its sub-directories) will be scanned, at which point it can be useful to pass the
sort
flag to rank the files by ABC magnitude:
$ python -m python_abc . --sort
./calculate.py <18, 56, 23> (63.2)
./vector.py <12, 23, 11> (28.2)
./main.py <10, 23, 8> (26.3)
./tests/test_vector.py <4, 19, 10> (21.8)
./tests/__init__.py <4, 12, 1> (12.7)
./tests/test_radon_test_cases.py <1, 2, 1> (2.4)
./tests/test_calculate_condition.py <1, 2, 1> (2.4)
./tests/test_calculate_empty.py <1, 2, 1> (2.4)
./tests/test_calculate_assignment.py <1, 2, 1> (2.4)
./tests/test_calculate_branch.py <1, 2, 1> (2.4)
Finally you can pass a cores
argument to tell the library how many CPU cores to use. By
default the library will try to use all the cores that are available on your machine.
FAQs
A python implementation of the ABC Software metric
We found that python-abc demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.