Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Unofficial Tapo API Client. Works with TP-Link Tapo smart devices. Tested with light bulbs (L510, L520, L530, L535, L610, L630), light strips (L900, L920, L930), plugs (P100, P105, P110, P115), power strips (P300, P304), hubs (H100), switches (S200B) and sensors (KE100, T100, T110, T300, T310, T315).
Unofficial Tapo API Client. Works with TP-Link Tapo smart devices. Tested with light bulbs (L510, L520, L530, L535, L610, L630), light strips (L900, L920, L930), plugs (P100, P105, P110, P115), power strips (P300, P304), hubs (H100), switches (S200B) and sensors (KE100, T100, T110, T300, T310, T315).
✓ - Rust only
✅ - Rust and Python
Feature | GenericDevice | L510 L520 L610 | L530 L535 L630 | L900 | L920 L930 | P100 P105 | P110 P115 | P300 P304 | H100 |
---|---|---|---|---|---|---|---|---|---|
device_reset | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |||
get_child_device_component_list_json | ✅ | ✅ | |||||||
get_child_device_list | ✅ | ✅ | |||||||
get_child_device_list_json | ✅ | ✅ | |||||||
get_current_power | ✅ | ||||||||
get_device_info | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
get_device_info_json | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
get_device_usage | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | |||
get_energy_data | ✅ | ||||||||
get_energy_usage | ✅ | ||||||||
off | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ||
on | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ||
refresh_session | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
set_brightness | ✅ | ✅ | ✅ | ✅ | |||||
set_color | ✅ | ✅ | ✅ | ||||||
set_color_temperature | ✅ | ✅ | ✅ | ||||||
set_hue_saturation | ✅ | ✅ | ✅ | ||||||
set_lighting_effect | ✅ | ||||||||
set() API * | ✅ | ✅ | ✅ |
* The set()
API allows multiple properties to be set in a single request.
✓ - Rust only
✅ - Rust and Python
Feature | KE100 | S200B | T100 | T110 | T300 | T310 T315 |
---|---|---|---|---|---|---|
get_device_info * | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
get_device_info_json | ✅ | ✅ | ✅ | ✅ | ✅ | ✅ |
get_temperature_humidity_records | ✅ | |||||
get_trigger_logs | ✅ | ✅ | ✅ | ✅ | ||
set_child_protection | ✅ | |||||
set_frost_protection | ✅ | |||||
set_max_control_temperature | ✅ | |||||
set_min_control_temperature | ✅ | |||||
set_target_temperature | ✅ | |||||
set_temperature_offset | ✅ |
* Obtained by calling get_child_device_list
on the hub device or get_device_info
on a child device handler.
Cargo.toml
[dependencies]
tapo = "0.7"
main.rs
let device = ApiClient::new("<tapo-username>", "tapo-password")
.p110("<device ip address>")
.await?;
device.on().await?;
export TAPO_USERNAME=
export TAPO_PASSWORD=
export IP_ADDRESS=
cargo run --example tapo_l530
See all examples in /tapo/examples.
tapo-rest is a REST wrapper of this library that can be deployed as a service or serve as an advanced example.
pip install tapo
client = ApiClient("<tapo-username>", "tapo-password")
device = await client.p110("<device ip address>")
await device.on()
cd tapo-py
poetry install # On the initial run
poetry shell
maturin develop # On the initial run and whenever the Rust code is modified
export TAPO_USERNAME=
export TAPO_PASSWORD=
export IP_ADDRESS=
python examples/tapo_p110.py
See all examples in /tapo-py/examples.
Contributions are welcome and encouraged! See /CONTRIBUTING.md.
Inspired by petretiandrea/plugp100.
FAQs
Unofficial Tapo API Client. Works with TP-Link Tapo smart devices. Tested with light bulbs (L510, L520, L530, L535, L610, L630), light strips (L900, L920, L930), plugs (P100, P105, P110, P115), power strips (P300, P304), hubs (H100), switches (S200B) and sensors (KE100, T100, T110, T300, T310, T315).
We found that tapo demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.