
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Tackle is a declarative DSL for building modular workflows and code generators. Tool is plugins based and can easily be extended by writing additional hooks or importing external providers that can be turned into a self documenting CLI, all out of yaml, json, toml.
Tackle is an experimental general purpose configuration language for building modular code generators and declarative CLIs. Built as a fork of cookiecutter, it can make any config file into a CLI with both strong and weakly typed programmable flow control common to a general purpose programming language. Basically you can write a fully functional Turing-complete program out of a config file. It's wild.
With tackle, you can build:
If this project gets enough adoption / stars, it will be re-written in a compiled language, either Go or Rust. Give it a star if you'd like to see that.
Note: tackle can install dependencies on its own. Check docs for advanced installation methods to isolate tackle from your system python.
python -m venv env && source env/bin/activate
pip install tackle
Quick Demo: tackle sudoblockio/tackle-hello-world
Check out the docs for >10 hello worlds that demonstrate the various aspects of the syntax with the simplest one using the print hook, one of >100 hooks.
hello.yaml
# Any time a key ends with `->`, we are calling a hook
hw->: print Hello world!
To run, call tackle hello.yaml
. Can also be version controlled -> tackle sudoblockio/tackle-hello-world
.
Can also use loops, conditionals, and other base methods.
hello.yaml
the:
words:
- Hello
- cruel
- world!
one liner->: print {{item}} --for the.words --if "item != 'cruel'"
multiple lines:
->: print
objects: {{item}}
for:
- Hello
- world!
if: item != 'cruel'
# Or combinations of the above with other methods like try/except
New hooks can be made in python which under the hood is a pydantic model.
.hooks/hello.py
from tackle import BaseHook
class Greeter(BaseHook):
hook_type: str = "greeter"
target: str
args: list = ['target']
def exec(self):
expression = f"Hello {self.target}"
print(expression)
return expression
Or can be defined inline within your tackle file, imported remotely, or in a hooks
directory..
.hooks/hello.yaml
# Keys ending with `<-` mean we are creating a hook / method
greeter<-:
target: str
args: ['target']
exec<-:
expression->: var Hello {{target}} # var hook renders variables
p->: print {{expression}}
return: expression
And both can be called the same way.
tackle.yaml
hello: world!
With a flag->: greeter --target {{hello}}
Target in argument->: greeter {{hello}}
Expanded fields:
->: greeter
target: {{hello}}
Jinja template->: {{ greeter(hello) }}
# Or combinations jinja and compact / expanded hooks allowing chaining of hook calls.
With the declarative hooks being callable from the command line:
tackle hello.yaml greeter --target world!
# Or from a github repo
tackle sudoblockio/tackle-hello-world greeter --target world!
Documentation can be embedded into the hooks.
hello.yaml
<-:
help: This is the default hook
target:
type: union[str, int]
default->: input
description: The thing to say hello to
exec<-:
greeting->: select Who to greet? --choices ['world',target]
hi->: greeter --target {{greeting}}
greeting-method<-:
help: A method that greets
# ... Greeting options / logic
extends: greeter
greeter<-:
help: A reusable greeter object
target: str
exec<-:
hi->: print Hello {{target}}
Which when running tackle hello.yaml help
produces its own help screen.
usage: tackle hello.yaml [--target]
This is the default hook
options:
--target [str] The thing to say hello to
methods:
greeting-method A method that greets
greeter A reusable greeter object
Hooks can be imported within a tackle provider or through hooks, linked, and/or combined with inheritance or composition creating a web of CLIs.
WIP Tutorials
Contributions are welcome but please be advised of the following notes.
make test
.It is very easy to create new providers / hooks with tackle. Over time, it will adopt the same import pattern of what Ansible does where all provider / hooks (modules) are stored in version controlled locations. In the meantime, please feel free to contribute to this repository for hooks that have general applicability or create your own hooks in other repositories that are more bespoke / opinionated in nature.
Everyone interacting in the tackle project's codebases, issue trackers, chat rooms, and mailing lists is expected to follow the PyPA Code of Conduct.
Special thanks to the cookiecutter community for laying the basis for this project.
FAQs
Tackle is a declarative DSL for building modular workflows and code generators. Tool is plugins based and can easily be extended by writing additional hooks or importing external providers that can be turned into a self documenting CLI, all out of yaml, json, toml.
We found that tackle demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.