Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Starfish is an open-sourced developer toolkit for the data economy. Available in flavours of Java, Python, and Clojure, it allows developers, data scientists and enterprises to create, interact, integrate and manage a data supply line through standardised and simple-to-use APIs.
Based on an underlying data ecosystem standard, Starfish provides high-level APIs for common tasks within the data economy, for example, registering/publishing an asset, for subsequent use in a data supply line. In this case, an asset can be any data set, model or data service. The high-level API also allows developers to invoke operation on an asset, e.g. computing a predictive model or anonymising sensitive personal information, among other capabilities.
Starfish works with blockchain networks, such as Ocean Protocol, and common web services through agents, allowing unprecedented flexibility in asset discovery and data supply line management.
Starfish-py provides user access and tools to work with the Ocean Protocol Network, delegating certain functions via the python library squid-py.
While we strive to deliver code at a high quality, please note, that there exist parts of the library that still need thorough testing. Contributions – whether it is in the form of new features, better documentation or tests – are welcome.
Python >= 3.6
Clone this repo
clone https://github.com/datacraft-dsc/starfish-py.git
cd starfish-py
Set up a virtual environment
virtualenv venv
source venv/bin/activate
Install package requirements for starfish
make install
Run the unit tests, without any supporting software/libraries outside of starfish
make test_unit
Create the local testing environment using datacraft-chain.
In a seperate terminal session you need to clone and checkout datacraft-chain
repository, by doing the following:
git clone https://github.com/datacraft-dsc/datacraft-chain.git
cd datacraft-chain
./start_datacraft_chain.sh test
Run the integration tests
pytest tests/integration
Run the all tests
make tests
Build Sphinx documentation
To build the Syphinx auto documentation, you need to do the following:
make docs
The documentation for this repo.
Automatic tests are setup via github actions. Our test use pytest framework. The testing uses a datacraft-chain docker image and surfer server. See github actions for testing
The bumpversion.sh
script helps to bump the project version. You can execute the script using as first argument {major|minor|patch} to bump accordingly the version.
See Release Process
Copyright 2018-2021 Datacraft Pte. Ltd.
Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
FAQs
Developer Toolkit for Decentralised Data Ecosystems
We found that starfish-py demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.