
Research
/Security News
Toptal’s GitHub Organization Hijacked: 10 Malicious Packages Published
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
This project provides a way to retrieve information from
typeshed <https://www.github.com/python/typeshed>
_ and from
PEP 561 <https://www.python.org/dev/peps/pep-0561/>
_ stub packages.
Example use cases:
Projects for which typeshed_client
could be useful include:
typeshed_client
works on all supported versions of Python. To install it, run
python3 -m pip install typeshed_client
.
The typeshed_client.finder
module provides functions for finding stub files
given a module name.
Functions provided:
get_search_context(*, typeshed: Path | None = None, search_path: Sequence[Path] | None = None, python_executable: str | None = None, version: PythonVersion | None = None, platform: str = sys.platform, raise_on_warnings: bool = False, allow_py_files: bool = False) -> SearchContext
:
Returns a SearchContext
, which can be used with most other functions to customize
stub finding behavior. All arguments are optional and the rest of the package will use
a SearchContext
created with the default values if no explicit context is provided.
The arguments are:
typeshed
: The path to the typeshed directory. If not provided, the package will
use the bundled version of typeshed.search_path
: A list of directories to search for stubs. If not provided,
sys.path
will be used.python_executable
: The path to the Python executable to be used for determining
search_path
.version
: Version of Python (as a pair, e.g., (3, 13)
) to be used for
interpreting sys.version_info
checks in stubs.platform
: The platform to be used for interpreting sys.platform
checks in
stubs. The default is sys.platform
, the platform where the library is invoked.raise_on_warnings
: If True, raise an exception if the parser encounters something
it does not understand.allow_py_files
: If True, allow searching for .py
files in addition to
.pyi
files. This is useful for typed packages that contain both stub files and
regular Python files. The default is False.typeshed_client.get_stub_file(module_name: str, *, search_context: SearchContext | None = None) -> Path | None
: Returns
the path to a module's stub file. For example,
get_stub_file('typing')
may return
Path('/path/to/typeshed/stdlib/typing.pyi')
. If there is no stub for the
module, returns None.
typeshed_client.get_stub_ast
has the same interface, but returns an AST
object (parsed using the standard library ast
module).
typeshed_client.parser
collects the names defined in a stub. It provides:
typeshed_client.get_stub_names(module_name: str, *, search_context: SearchContext | None = None) -> NameDict | None
collects the names
defined in a module, using the given Python version and platform. It
returns a NameDict
, a dictionary mapping object names defined in the module
to NameInfo
records.
typeshed_client.NameInfo
is a namedtuple defined as:
.. code-block:: python
class NameInfo(NamedTuple):
name: str
is_exported: bool
ast: ast.AST | ImportedName | OverloadedName
child_nodes: NameDict | None = None
name
is the object's name. is_exported
indicates whether the name is a
part of the stub's public interface. ast
is the AST node defining the name,
or a different structure if the name is imported from another module or is
overloaded. For classes, child_nodes
is a dictionary containing the names
defined within the class.
The third component of this package, typeshed_client.resolver
, maps names to
their definitions, even if those names are defined in other stubs.
To use the resolver, instantiate the typeshed_client.Resolver
class. For example, given a resolver = typeshed_client.Resolver()
, you can
call resolver.get_fully_qualified_name('collections.Set')
to retrieve the
NameInfo
containing the AST node defining collections.Set
in typeshed.
Version 2.8.1 (July 15, 2025)
Version 2.8.0 (July 15, 2025)
.py
files in addition to .pyi
filesOverloadedName
objects can now
contain ImportedName
objects.Version 2.7.0 (July 16, 2024)
Version 2.6.0 (July 12, 2024)
try
blocks in stubsVersion 2.5.1 (February 25, 2024)
Version 2.5.0 (February 25, 2024)
typeshed_client.finder.get_search_path()
is now deprecated, as it is no longer usefulVersion 2.4.0 (September 29, 2023)
Version 2.3.0 (April 30, 2023)
__all__.append
and __all__.extend
Version 2.2.0 (January 24, 2023)
if MYPY
import *
in stubsVersion 2.1.0 (November 5, 2022)
typeshed_client.resolver.Module.get_dunder_all
to get the contents of __all__
__all__ +=
syntaxVersion 2.0.5 (April 17, 2022)
Version 2.0.4 (March 10, 2022)
Version 2.0.3 (February 2, 2022)
Version 2.0.2 (January 28, 2022)
Version 2.0.1 (January 14, 2022)
Version 2.0.0 (December 22, 2021)
ast
instead of typed_ast
for parsingVersion 1.2.3 (December 12, 2021)
get_all_stub_files()
in Python 3 for modules that also exist in Python 2Version 1.2.2 (December 9, 2021)
Version 1.2.1 (December 9, 2021)
Version 1.2.0 (December 6, 2021)
Version 1.1.4 (December 6, 2021)
Version 1.1.3 (November 14, 2021)
mypy_extensions
Version 1.1.2 (November 5, 2021)
Version 1.1.1 (July 31, 2021)
Version 1.1.0 (June 24, 2021)
@python2
directoryVersion 1.0.2 (May 5, 2021)
Version 1.0.1 (April 24, 2021)
Version 1.0.0 (April 11, 2021)
Version 1.0.0rc1 (April 11, 2021)
Version 0.4 (December 2, 2019)
Version 0.3 (November 23, 2019)
Version 0.2 (May 25, 2017)
get_all_stub_files()
from module import *
Version 0.1 (May 4, 2017)
FAQs
A library for accessing stubs in typeshed.
We found that typeshed-client demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Threat actors hijacked Toptal’s GitHub org, publishing npm packages with malicious payloads that steal tokens and attempt to wipe victim systems.
Research
/Security News
Socket researchers investigate 4 malicious npm and PyPI packages with 56,000+ downloads that install surveillance malware.
Security News
The ongoing npm phishing campaign escalates as attackers hijack the popular 'is' package, embedding malware in multiple versions.