
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
replgpt
is a Python hacking tool that lets you seamlessly switch between code authoring, LLM code generation, and code execution, all within a single terminal session. Imagine using a REPL, and being able to switch between Python and natural language, and being able to execute both.
If you've ever been frustrated with copying and pasting code generated by ChatGPT and some other environment, this is the tool for you.
replgpt is not an IDE. It is not an editor based coding agent, though it shares some functionality. If you are building a new feature on an existing code base, this may not be the best tool for that job. However, if you want to work with generated Python code without toggling between windows, are looking to jump start building a new idea with Python, want to learn about an existing library, it might be up your alley.
Install replgpt
directly from PyPI:
pip install replgpt
Set the OPENAI_API_KEY environment variable with your OpenAI API key:
export OPENAI_API_KEY="your-openai-api-key"
After installing, start the REPL with:
replgpt
Enter any valid Python code. When executed, the command and it's output will be included in the Agent's memory.
Enter a query to the AI Agent. It can answer questions you have about the code you've run or errors you've seen. Help you debug code that isn't behaving in a way you'd expect. Or, ask the Agent to write a function for you which will automatically become availabe in your REPL session.
There are several commands you can issue to the REPL to control its behavior:
/help - Print additional information about the REPL and commands you can run.
/file_to_context <file_path> - Read the contents of a local file and load it into the Agent's context window. This is can
be used to import documentation into the Agent's memory, or give it knowledge of existing code you'd like to work with inside
of the REPL. Or, if you want to understand a project's dependencies better, run /file_to_context requirements.txt
and ask
your agent about the libraries the libraries used.
/auto_eval - Controls what the REPL will do with code generated by your AI agent. The default strategy of 'always'
means that any code returned by the Agent will be executed. If you have any concerns about this behavior, you can toggle this
to never
. Alternatively, the 'infer' strategy will make an additional LLM to evaluate the safety of the generated code. In
practice this should only allow definitions (functions and classes) but will not execute code that could have side effects.
FAQs
An interactive REPL with GPT-based assistance
We found that replgpt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.