
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
tessa
Advanced tools
Find financial assets and get their price history without worrying about different APIs or rate limiting.
tessa is a Python library to help you easily retrieve price information for assets from different sources such as Yahoo or Coingecko. It takes care of the different APIs, caching, rate limiting, and other hassles.
tessa provides a Symbol class that encapsulates the methods relevant for a symbol. tessa also provides functionality to manage collections of symbols, store and load them, and extend their functionality.
Finally, tessa makes sure to be nice to the sites being accessed and tries to prevent users from being blocked by 429 rate limiting errors by 1) caching results upon retrieval and 2) keeping track of request timestamps and waiting appropriate amounts of time if necessary. tessa also automatically waits and retries requests that fail with a 5xx error.
→ Check out the full documentation. 📖
Here's a longer example that shows all aspects of the library. Refer to submodules symbol, search, and price for more information.
from tessa import Symbol, SymbolCollection, search
import pendulum
s1 = Symbol("MSFT") # will use "yahoo" as the default source
s1.price_latest() # get latest price
s2 = Symbol("SREN.SW")
s2.price_point("2022-06-30") # get price at specific point in time
s3 = Symbol("bitcoin", source="coingecko")
s3.price_graph() # show price graph
res = search("name") # search and print search result summary
filtered = res.filter(source="coingecko") # filter results
filtered.p() # print summary of filtered results
filtered.buckets[1].symbols # review the 2nd bucket in the filtered results
s4 = filtered.buckets[1].symbols[4] # our symbol is the 5th in that list
s4.price_history() # get entire history
s4.price_graph() # visualize the price history
sc = SymbolCollection([s1, s2, s3, s4]) # create a collection w/ symbols from above
sc.add(Symbol("AAPL")) # add another one
sc.find_one("SREN").price_graph()
sc.save_yaml("my_symbols.yaml")
sc_new = SymbolCollection()
sc_new.load_yaml("my_symbols.yaml")
sc.find_one("ens").price_latest() # will return price in USD
Symbol.currency_preference = "CHF"
sc.find_one("ens").price_latest() # will return price in CHF
Note that currency_preference will only have an effect with sources that support it.
It is supported for Coingecko but not for Yahoo. So you should always verify the
effective currency you receive in the result.
On Yahoo, some tickers are listed in several currency-specific variants that you can try:
Symbol("ETH-USD").price_latest() # will return the price in USD
Symbol("ETH-EUR").price_latest() # will return the price in EUR
Coingecko only provides a limited amount of historical data:
from_date = (pendulum.now() - pendulum.duration(months=6)).to_date_string()
Symbol("bitcoin", source="coingecko").price_point(from_date)
# Will work because coingecko has data for the last year
Symbol("bitcoin", source="coingecko").price_point("2020-08-01")
# Will result in a value error as the data is not available
Yahoo also lists a number of crypto assets with longer history, so you can try that source as well:
Symbol("BTC-USD").price_point(from_date) # Should work, "yahoo" is the default source
price_point tries to be lenient and you can adjust the leniency:By default, price_point will try to find the closest price to the requested date as
long as it's not more than max_date_deviation_days days away (default: 10 days).
ea = Symbol("EA")
ea.price_point("2022-01-01") # Will return the price for 2021-12-31
Symbol.max_date_deviation_days = 0
ea.price_point("2022-01-01") # Will raise a ValueError
tessa builds on yfinance and pycoingecko and offers a simplified and unified interface.
Why these two sources? Yahoo Finance (via yfinance) is fast and offers an extensive database that also contains many non-US markets and many crypto tokens. Coingecko (via pycoingecko) offers great access to crypto prices, but is limited to 1 year of historical data.
More sources can be added in the future. Let me know in the issues of you have a particular request.
Symbol class.pip install tessa
Requires Python 3.10 or higher.
See pyproject.toml. Major prerequisites are the yfinance and pycoingecko packages
to access finance information.
https://github.com/ymyke/tessa
I'm using symbol instead of ticker because a ticker is mainly used for stock on stock markets, whereas tessa is inteded to be used for any kind of financial assets, e.g. also crypto.
FAQs
Find financial assets and get their price history without worrying about different APIs or rate limiting.
We found that tessa demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.