Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
This pacakge provides two things:
See the ARCHITECTURE file
Starting using the module's classes is pretty easy:
In the following case it is used a predefined GitLab.com endpoint, with no token paramter passed (anonymous). The Projects resource used with a Read operation will list some/all projects.
from gitlab.utils import ppjson
from gitlab.resources import Projects
from gitlab.endpoints import GitLabDotCom
ppjson(Projects(GitLabDotCom()).read())
In following case it is used a predefined GitLab.com endpoint, with a token. The Projects resource used with a Read operation will list some/all projects.
from gitlab.utils import ppjson
from gitlab.resources import Projects
from gitlab.endpoints import GitLabDotCom
ppjson(Projects(GitLabDotCom(token='SOME TOKEN')).read({'owned':True}))
In the following case, a generic endpoint is used. GitLabEndpoint' can receive in its constructor an URL and token, or take it from the environment. The environmental variables
API_AUTH_TOKENand
GITLAB_API_V4_URL(or
CI_API_V4_URL` to be compatible with GitlabCI environments) should be set.
e.g.
API_AUTH_TOKEN='123456'
CI_API_V4_URL='https://gitlab.aws.agileanalog.com/api/v4'
And the related code using such environment:
from gitlab.utils import ppjson
from gitlab.resources import Projects
from gitlab.endpoints import GitLabEndpoint
ppjson(Projects(GitLabEndpoint.from_env()).read({'owned':True}))
Currently only personal access tokens are supported.
Feel free to suggest ways to introduce the support for OAuth2 contacting the author and then proposing a change with a merge request.
Some command-line utilties which maps 1:1 to the API resources are provided as entry-points of the python package.
The utlities are meant to be used for quick scripting, but they support environmental variables and dash-dash
parameters, so that they can be used in CICD environment.
Such mapping utilities are meant to return JSON, as provided by the API.
### Package versions
Some basic version management can be used in CICD to automatically release or query about the release version of a package
All contribution are welcome, in the best open source tradition.
Before adding missing features, please contact the author first to discuss best ways to do it.
New resources can be added via merge requests directly, as they are supposed to be really easy to add.
FAQs
Programmatic REST Client for GitLab
We found that python-gitlab-api demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.