Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
SMASHED is a toolkit designed to apply transformations to samples in datasets, such as fields extraction, tokenization, prompting, batching, and more. Supports datasets from Huggingface, torchdata iterables, or simple lists of dictionaries.
Sequential MAppers for Sequences of HEterogeneous Dictionaries is a set of Python interfaces designed to apply transformations to samples in datasets, which are often implemented as sequences of dictionaries. To start, run
pip install smashed
Mappers are initialized and then applied sequentially. In the following example, we create a mapper that is applied to a samples, each containing a sequence of strings. The mappers are responsible for the following operations.
import transformers
from smashed.mappers import (
TokenizerMapper,
MultiSequenceStriderMapper,
TokensSequencesPaddingMapper,
AttentionMaskSequencePaddingMapper,
SequencesConcatenateMapper,
)
tokenizer = transformers.AutoTokenizer.from_pretrained(
pretrained_model_name_or_path='bert-base-uncased',
)
mappers = [
TokenizerMapper(
input_field='sentences',
tokenizer=tokenizer,
add_special_tokens=False,
truncation=True,
max_length=80
),
MultiSequenceStriderMapper(
max_stride_count=2,
max_length=512,
tokenizer=tokenizer,
length_reference_field='input_ids'
),
TokensSequencesPaddingMapper(
tokenizer=tokenizer,
input_field='input_ids'
),
AttentionMaskSequencePaddingMapper(
tokenizer=tokenizer,
input_field='attention_mask'
),
SequencesConcatenateMapper()
]
dataset = [
{
'sentences': [
'This is a sentence.',
'This is another sentence.',
'Together, they make a paragraph.',
]
},
{
'sentences': [
'This sentence belongs to another sample',
'Overall, the dataset is made of multiple samples.',
'Each sample is made of multiple sentences.',
'Samples might have a different number of sentences.',
'And that is the story!',
]
}
]
for mapper in mappers:
dataset = mapper.map(dataset)
print(len(dataset))
# >>> 5
print(dataset[0])
# >>> {
# 'input_ids': [
# 101,
# 2023,
# 2003,
# 1037,
# 6251,
# 1012,
# 102,
# 2023,
# 2003,
# 2178,
# 6251,
# 1012,
# 102
# ],
# 'attention_mask': [
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1,
# 1
# ]
# }
Mappers can also be composed into a pipeline using the >>
(or <<
) operator. For example, the code above can be rewritten as follows:
pipeline = TokenizerMapper(
input_field='sentences',
tokenizer=tokenizer,
add_special_tokens=False,
truncation=True,
max_length=80
) >> MultiSequenceStriderMapper(
max_stride_count=2,
max_length=512,
tokenizer=tokenizer,
length_reference_field='input_ids'
) >> TokensSequencesPaddingMapper(
tokenizer=tokenizer,
input_field='input_ids'
) >> AttentionMaskSequencePaddingMapper(
tokenizer=tokenizer,
input_field='attention_mask'
) >> SequencesConcatenateMapper()
dataset = ...
# apply the full pipeline to the dataset
pipeline.map(dataset)
The initial version of SMASHED supports two interfaces for dataset:
interfaces.simple.Dataset
: A simple dataset representation that is just a list of python dictionaries with some extra convenience methods to make it work with SMASHED. You can crate a simple dataset by passing a list of dictionaries to interfaces.simple.Dataset
.datasets
library. SMASHED mappers work with any datasets from HuggingFace, whether it is a regular or iterable dataset.To contribute to SMASHED, make sure to:
pip install -r dev-requirements.txt
.black .
(Should format for you)flake8 .
(Should return no error)isort .
(Should sort imports for you)mypy .
(Should return no error)pytest -v --color=yes tests/
(Should return no error)soldni
to review the PR.SMASHED follows Semantic Versioning. In short, this means that the version number is MAJOR.MINOR.PATCH, where:
FAQs
SMASHED is a toolkit designed to apply transformations to samples in datasets, such as fields extraction, tokenization, prompting, batching, and more. Supports datasets from Huggingface, torchdata iterables, or simple lists of dictionaries.
We found that smashed demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.