
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
A manipulation and optimization library for Scalable Vector Graphics
CDATA
, comments, text)rgb
, rgba
, hsl
, hex
, named
)html.parser
, lxml
, html5lib
)transform
attribute ("reification")---
title: Entity hierarchy
---
graph TD
Entity:::abc --> CharacterData
Entity --> Element
Element:::abc --> G
Element --> Svg
Element --> Rect
Element --> Circle
Element --> etc1[...]
CharacterData:::abc --> RawText
CharacterData --> Comment
CharacterData --> CData
etc1:::etc
classDef abc stroke:white,stroke-width:2px;
classDef etc stroke:gray,stroke-width:2px;
classDef default stroke:orange,stroke-width:2px;
From PyPi:
pip install svglab
From source:
# Via HTTPS
pip install git+https://github.com/reznakt/svglab.git
# Via SSH
pip install git+ssh://git@github.com/reznakt/svglab.git
# Parse an existing SVG file
svg = parse_svg(
"""
<svg xmlns="http://www.w3.org/2000/svg" width="100" height="100">
<g>
<rect
id="background"
width="100cm"
height="100%"
transform="rotate(45)"
stroke="red"
/>
<rect color="hsl(0, 100%, 100%)"/>
<!-- This is a comment -->
<![CDATA[.background { fill: blue; }]]>
Hello SVG!
<path d="M 10,10 H 10 L 100,100 Q 100,100 50,50 v 100 Z"/>
<path d="M0,0 10,10 20,20 S 100,100 50,50 t 100,100 M 50,50 z"/>
<path d="M0,0A50,50 90 1 0 100,100v100h-10z"/>
<polygon points="0,0 100,0 100,100 0,100"/>
</g>
</svg>
"""
)
print(svg)
# Create an element programmatically
group = G().add_children(
Rect(
width=Length(15, "px"),
height=Length(20),
transform=[SkewX(45.123), Translate(10, 20)],
color=Color("#ff0000"),
),
Comment("This is a comment"),
CData(".background { fill: blue; }"),
RawText("Hello SVG!"),
Path(
d=D()
.move_to(Point(10, 10))
.line_to(Point(100, 100))
.quadratic_bezier_to(Point(100, 100), Point(50, 50))
.smooth_quadratic_bezier_to(Point(100, 100))
.move_to(Point(50, 50))
.cubic_bezier_to(
Point(100, 100), Point(100, 100), Point(10, 10)
)
.smooth_cubic_bezier_to(Point(100, 100), Point(50, 50))
.arc_to(
Point(50, 50), 90, Point(100, 100), large=True, sweep=False
)
.vertical_line_to(100)
.horizontal_line_to(-10, relative=True)
.close()
),
Polyline(
points=[
Point(0, 0),
Point(100, 0),
Point(100, 100),
Point(0, 100),
],
stroke_linecap="square",
opacity=0.5,
),
)
# Add the element to the SVG
svg.add_child(group)
# Manipulate attributes
print(svg.xmlns) # http://www.w3.org/2000/svg
svg.x = Length(10, "px")
# Save to a file
svg.save(sys.stdout)
# Search the entity tree
print(*svg.find_all(Rect), sep="\n")
rect = svg.find(G).find(Rect)
# Compute the bounding box and mask of an element
print(rect.get_bbox())
print(rect.get_mask())
# Render the SVG to an image
image = svg.render()
print(image)
# Apply transformations in the transform attribute
svg.reify()
print(svg.to_xml())
# Change the view box
svg.set_viewbox((0, 0, 50, 50))
print(svg.to_xml())
# Install dependencies
poetry install
# Activate the virtual environment
poetry shell
# Optional: Install pre-commit hooks
pre-commit install
# Run tests
poe test
# Run type checker
poe typecheck
# Run linter
poe lint
# Fix linting errors
poe lint-fix
# Run formatter
poe format
# Fix formatting errors
poe format-fix
This software is distributed under the MIT License. See LICENSE
for more information.
FAQs
A manipulation and optimization library for Scalable Vector Graphics
We found that svglab demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.