Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
apply a consistent format to tox.ini
files
pip install tox-ini-fmt
See pre-commit for instructions
Sample .pre-commit-config.yaml
:
- repo: https://github.com/tox-dev/tox-ini-fmt
rev: "1.3.1"
hooks:
- id: tox-ini-fmt
args: ["-p", "fix_lint,type"]
Consult the help for the latest usage:
$ tox-ini-fmt --help
usage: tox-ini-fmt [-h] [-s] [-p toxenv] tox_ini
positional arguments:
tox_ini tox ini file to format
optional arguments:
-h, --help show this help message and exit
-s, --stdout print the formatted text to the stdout (instead of update in-place)
-p toxenv tox environments that pin to the start of the envlist (comma separated)
tox
/testenv:*
(other than put this sections to the end of the file)boolean
fields are normalized to true
or false
commands
) are moved to the start of the list (order kept)Applies the following section order:
tox
testenv
testenv:*
- py
/pypy
envs are ordered in decreasing order by python version, then apply the order defined within
envlist
part of tox
section, you can pin tox elements to the start by using the -p
flagtox
sectionOrder by:
envlist
- multi-line, start with py
envs in decreasing python order, then same with pypy
, then everything elseisolated_build
- boolean
fieldskipsdist
- boolean
fieldskip_missing_interpreters
- boolean
fieldminversion
testenv
sectionOrder by:
description
passenv
- multi-line, one environment name to pass per line, sorted by namesetenv
- multi-line, one environment name-value to set per line in format of key=value
, sorted by key+valuebasepython
skip_install
- boolean
fieldusedevelop
- boolean
fielddeps
- multi-line, order by package name (but keep dependencies with package names separate at end), normalize
format to remove extra spacesextras
- multi-line, one extra env per lineparallel_show_output
- boolean
fieldcommands
- one command per line, commands that wrap over multiple lines are indented with line two or later by
extra four spacesFAQs
tox is a generic virtualenv management and test command line tool
We found that tox-ini-fmt demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.