Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Totally inspired by Yesql from Clojure world. But implemented in another way.
I totally agree with Yesql's author that SQL is already a mature DSL and great abstaction layer for DB queries building. And we don't need another layer above SQL to work with RDBMS like ORMs or complicated DSLs. Feel free to use all of the SQL's power in your projects without mixing Python code and SQL strings. Solution is very simple and flexible enough to try it in your next project. Also, Snaql doesn't depend on DB clients, can be used in asynchronous handlers (Tornado, for example). It's just a way to organize your queries and a bit of logic to change them by context. Look at examples.
Actually, Snaql doesn't care about stuff you want to build. SQL, SPARQL, SphinxQL, CQL etc., you can build any query for any DB or search engine. Freedom.
As usual, with pip:
$ pip install snaql
You always can find the most recent docs with examples on Snaql GitBook
Simple, without DB clients dependencies (use what you need). Try!
Tested in Python 2.7, 3.3, 3.4, 3.5
FAQs
Transparant *QL usage without ORM
We found that snaql demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.