Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The sentinels module is a small utility providing the Sentinel class, along with useful instances.
Sentinels are objects with special meanings. They can be thought of as singletons, but they service the need of having 'special' values in your code, that have special meanings (see example below).
Let's take NOTHING for example. This sentinel is automatically provided with the sentinels import::
from sentinels import NOTHING
Let's say you're writing a wrapper around a Python dictionary, which supports a special kind of method, get_default_or_raise. This method behaves like get, but when it does not receive a default and the key does not exist, it raises a KeyError. How would you implement such a thing? The naive method is this::
class MyDict(dict): ... def get_default_or_raise(self, key, default=None): ... if key not in self and default is None: ... raise KeyError(key) ... return self.get(key, default)
Or even this::
class MyDict(dict): ... def get_default_or_raise(self, key, default=None): ... returned = self.get(key, default) ... if returned is None: ... raise KeyError(key) ... return returned
But the problem with the above two pieces of code is the same -- when writing a general utility class, we don't know how it will be used later on. More importantly, None might be a perfectly valid dictionary value!
This is where NOTHING comes in handy::
class MyDict(dict): ... def get_default_or_raise(self, key, default=NOTHING): ... returned = self.get(key, default) ... if returned is NOTHING: ... raise KeyError(key) ... return returned
And Tada!
Sentinels are always equal to themselves::
NOTHING == NOTHING True
But never to another object::
from sentinels import Sentinel NOTHING == 2 False NOTHING == "NOTHING" False
Copying sentinels returns the same object::
import copy copy.deepcopy(NOTHING) is NOTHING True
And of course also pickling/unpickling::
import pickle NOTHING is pickle.loads(pickle.dumps(NOTHING)) True
FAQs
Various objects to denote special meanings in python
We found that sentinels demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.