Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
The py-tree-sitter project (not to be confused with tree-sitter-python) provides Python bindings for the awesome tree-sitter parsing library. The documentation of py-tree-sitter says that you need to have a C compiler installed to use it, but installing a C compiler can be highly non-trivial depending on which operating system you have. It's also a huge dependency for what is otherwise a small and simple parsing library.
This project lets you use py-tree-sitter without a C compiler by providing binary wheels that were built using a C compiler, but don't require a C compiler to be installed. The wheels contain:
tree_sitter
module from py-tree-sitter v0.20.1tree_sitter_languages
module from py-tree-sitter-languages v1.5.0$ pip install tree-sitter-builds
After installing, import tree_sitter
and import tree_sitter_languages
should work.
For documentation, see the documentation of:
tree_sitter_languages
instead of the "Setup" part)Read .github/workflows/build.yml
to see how GitHub actions builds the wheels.
Here are the steps, at a high level:
tree_sitter
and tree_sitter_languages
tree_sitter
and tree_sitter_languages
so that they work hereThe wheels consist of various parts licensed under MIT and Apache 2.0 licenses:
FAQs
Python bindings to the Tree-sitter parsing library
We found that tree-sitter-builds demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.