Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
trio-asyncio
is a re-implementation of the asyncio
mainloop on top of
Trio.
There are quite a few asyncio-compatible libraries.
On the other hand, Trio has native concepts of tasks and task cancellation. Asyncio, on the other hand, is based on chaining Future objects, albeit with nicer syntax.
Thus, being able to use asyncio libraries from Trio is useful.
The core of the "normal" asyncio main loop is the repeated execution of
synchronous code that's submitted to call_soon
or
add_reader
/add_writer
.
Everything else within asyncio
, i.e. Futures and async
/await
,
is just syntactic sugar. There is no concept of a task; while a Future can
be cancelled, that in itself doesn't affect the code responsible for
fulfilling it.
On the other hand, trio has genuine tasks with no separation between returning a value asynchronously, and the code responsible for providing that value.
trio_asyncio
implements a task which runs (its own version of) the
asyncio main loop. It also contains shim code which translates between these
concepts as transparently and correctly as possible, and it supplants a few
of the standard loop's key functions.
This works rather well: trio_asyncio
consists of just ~700 lines of
code (asyncio: ~8000) but passes the complete Python 3.6 test suite with no
errors.
trio_asyncio
requires Python 3.8 or later.
Matthias Urlichs matthias@urlichs.de
FAQs
A re-implementation of the asyncio mainloop on top of Trio
We found that trio-asyncio demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.