Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This package provides software methods to Translator components (e.g. Knowledge Providers and Autonomous Relay Agents) using any version of the Translator Reasoner API (TRAPI) and the Biolink Model.
See the full documentation and the contributor guidelines.
The Reasoner Validator now requires Python 3.9 or later (some library dependencies now force this).
The module may be installed directly from pypi.org using (Python 3) pip
or pip3
, namely:
pip install reasoner-validator
As of release 3.1.6, this project uses the poetry dependency management tool to orchestrate its installation and dependencies.
After installing poetry and cloning the project, the poetry installation may be run (within the available poetry shell):
git clone https://github.com/NCATSTranslator/reasoner-validator.git
cd reasoner-validator
poetry use 3.10
poetry shell
poetry install
Note that the poetry env
can be set to either Python 3.10 or 3.11 at the present time.
This installation also installs testing dependencies (in the poetry 'dev' group in the pyproject.toml) and documentation dependencies (in the corresponding poetry 'docs' group). If you don't want the overhead of these dependencies, then the installation of these poetry group dependencies may be excluded:
poetry install --without dev,docs
If you plan to run the web service API, then install it with the optional web group:
poetry install reasoner-validator --with web
A local script trapi_validator.py
is available to run TRAPI Response validation against either a PK (UUID)
indexed query result of the Biomedical Knowledge Translator "Autonomous Relay System" (ARS), a local JSON Response
text file or a locally triggered ad hoc query Request against a directly specified TRAPI endpoint.
Note that it is best run within a poetry shell
created by poetry install
.
For script usage, type:
./trapi_validator.py --help
(*) Thank you Eric Deutsch for the prototype code for this script
Run the available unit tests with coverage report:
poetry run pytest --cov
Note that poetry automatically uses any existing virtual environment, but you can otherwise also enter the one that is created by poetry by default:
poetry shell
# run your commands, e.g. the web service module
exit # exit the poetry shell
The use of the Poetry shell command allows for running of the tests without the poetry run
prefix. We will continue in this manner.
% poetry shell
(reasoner-validator-py3.9) % pytest --cov
Run the tests with detailed coverage report in a HTML page:
pytest --cov --cov-report html
Serve the report on http://localhost:3000:
python -m http.server 3000 --directory ./htmlcov
All paths here are relative to the root project directory. The validation codes MarkDown file should first be regenerated if needed (i.e. if the codes.yaml
was revised):
cd reasoner_validator
python ./validation_codes.py
Then build the documentation locally:
cd ../docs
make html
The resulting index.html and related pages describing the programmatic API are now available for viewing within the docs subfolder _build/html.
The Reasoner Validator is available wrapped as a simple web service. The service may be run directly or as a Docker container.
The web service has a single POST endpoint /validate
taking a simple JSON request body, as follows:
{
"trapi_version": "1.4.1",
"biolink_version": "3.5.0",
"target_provenance": {
"ara_source": "infores:aragorn",
"kp_source": "infores:panther",
"kp_source_type": "primary"
},
"strict_validation": true,
"response": "{<some full JSON object of a TRAPI query Response...>}"
}
The request body consists of JSON data structure with two top level tag:
trapi_version
tag can be given a value of the TRAPI version against which the message will be validated, expressed as a SemVer string (defaults to 'latest' if omitted; partial SemVer strings are resolved to their 'latest' minor and patch releases). This value may also be a GitHub branch name (e.g. 'master').biolink_version
tag can be given a value of the Biolink Model version against which the message knowledge graph semantic contents will be validated, expressed as a SemVer string (defaults to 'latest' Biolink Model Toolkit supported version, if omitted).target_provenance
with an object dictionary (example shown) specifying the ARA and KP infores-specified knowledge sources expected to be recovered in the TRAPI query results (specified by infores CURIE) and the expected KP provenance source type, i.e. 'primary' implies that the KP is tagged as a 'biolink:primary_knowledge_source'. Optional in that the root "target_provenance" or any of the subsidiary tags may be omitted (default to None)strict_validation
flag (default: None or 'false'). If 'true' then follow strict validation rules, such as treating as 'error' states the use of category
, predicate
and attribute_type_id
that are of type abstract
or mixin
as errors.message
tag should have as its value the complete JSON TRAPI Response to be validated (See the example below)First install the web-specific dependencies, if not already done (e.g. by --all-extras
above):
poetry install --extras web # or poetry install --all-extras
The service may be run directly as a Python module. The web services module may be directly run, as follows.
python -m api.main
Go to http://localhost/docs to see the service documentation and to use the simple UI to input TRAPI messages for validation.
As an example of the kind of output to expect, if one posts the following TRAPI Response JSON data structure to the /validate endpoint:
{
"trapi_version": "1.4.2",
"biolink_version": "4.1.5",
"response": {
"message": {
"query_graph": {
"nodes": {
"type-2 diabetes": {"ids": ["MONDO:0005148"]},
"drug": {"categories": ["biolink:Drug"]}
},
"edges": {
"treats": {"subject": "drug", "predicates": ["biolink:treats"], "object": "type-2 diabetes"}
}
},
"knowledge_graph": {
"nodes": {
"MONDO:0005148": {"name": "type-2 diabetes"},
"CHEBI:6801": {"name": "metformin", "categories": ["biolink:Drug"]}
},
"edges": {
"df87ff82": {"subject": "CHEBI:6801", "predicate": "biolink:treats", "object": "MONDO:0005148"}
}
},
"results": [
{
"node_bindings": {
"type-2 diabetes": [{"id": "MONDO:0005148"}],
"drug": [{"id": "CHEBI:6801"}]
},
"edge_bindings": {
"treats": [{"id": "df87ff82"}]
}
}
]
},
"workflow": [{"id": "annotate"}]
}
}
one should typically get a response body something like the following JSON validation result back:
{
"messages": {
"Validate TRAPI Response": {
"Standards Test": {
"info": {
"info.query_graph.edge.predicate.mixin": {
"global": {
"biolink:treats": [
{
"edge_id": "drug[biolink:Drug]--['biolink:treats']->type-2 diabetes[None]"
}
]
}
}
},
"skipped": {},
"warning": {},
"error": {
"error.query_graph.edge.predicate.invalid": {
"global": {
"biolink:treats": [
{
"edge_id": "drug[biolink:Drug]--['biolink:treats']->type-2 diabetes[None]"
}
]
}
}
},
"critical": {}
}
}
},
"trapi_version": "v1.4.2",
"biolink_version": "4.1.5"
}
To minimize redundancy in validation messages, messages are uniquely indexed in dictionaries at two levels:
NOTE: OpenTelemetry is temporarily disabled in this code release (to be updated later)
The web service may be monitored for OpenTelemetry by setting an environment variable TELEMETRY_ENDPOINT to a suitable trace collecting endpoint in an application like Jaeger (see also the Translator SRI Jaeger-Demo).
Note: the current system Docker (Compose) design only supports OpenTemplate tracing using the internal Jaeger container and may require further refinements to enable use of an external telemetry collector.
The Reasoner Validator web service may be run inside a docker container, using Docker Compose.
First, from the root project directory, build the local docker container
docker-compose build
Then, run the service:
docker-compose up -d
Once again, go to http://localhost/docs to see the service documentation.
To stop the service:
docker-compose down
Of course, the above docker-compose commands may be customized by the user to suit their needs. Note that the docker implementation assumes the use of uvicorn
Summary of earlier releases and current Change Log is here.
biolink:Association
etc. domain
and range
constraints)FAQs
Validation tools for Reasoner API
We found that reasoner-validator demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.