Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Util for python code execution and state serialization.
You can install module from PyPI:
python -m pip install utbot-executor
Run with your <hostname>
and <port>
for socket connection
$ python -m utbot_executor <hostname> <port> <logfile> [<loglevel DEBUG | INFO | ERROR>] <coverage_hostname> <coverage_port>
{
"functionName": "f",
"functionModule": "my_module.submod1",
"imports": ["sys", "math", "json"],
"syspaths": ["/home/user/my_project/"],
"argumentsIds": ["1", "2"],
"kwargumentsIds": ["4", "5"],
"serializedMemory": "string",
"memoryMode": "REDUCE",
"filepath": ["/home/user/my_project/my_module/submod1.py"],
"coverageId": "1"
}
functionName
- name of the tested functionfunctionModule
- name of the module of the tested functionimports
- all modules which need to run function with current argumentssyspaths
- all syspaths which need to import modules (usually it is a project root)argumentsIds
- list of argument's idskwargumentsIds
- list of keyword argument's idsserializedMemory
- serialized memory throw deep_serialization
algorithmmemoryMode
- serialization mode (PICKLE
, REDUCE
)filepath
- path to the tested function's containing filecoverageId
- special id witch will be used for sending information about covered linesIf execution is successful:
{
"status": "success",
"isException": false,
"statements": [1, 2, 3],
"missedStatements": [4, 5],
"stateInit": "string",
"stateBefore": "string",
"stateAfter": "string",
"diffIds": ["3", "4"],
"argsIds": ["1", "2", "3"],
"kwargs": ["4", "5", "6"],
"resultId": "7"
}
status
- always "success"isException
- boolean value, if it is true
, execution ended with an exceptionstatements
- list of the numbers of covered rowsmissedStatements
- list of numbers of uncovered rowsstateInit
- serialized states from requeststateBefore
- serialized states of arguments before executionstateAfter
- serialized states of arguments after executiondiffIds
- ids of the objects which have been changedargsIds
- ids of the function's argumentskwargsIds
- ids of the function's keyword argumentsresultId
- id of the returned valueor error format if there was exception in running algorith:
{
"status": "fail",
"exception": "stacktrace"
}
status
- always "fail"exception
- string representation of the exception stack tracedeep_serialization
JSON serializer and deserializer for python objects
{
"objects": {
"id": {
"id": "1",
"strategy": "strategy name",
"typeinfo": {
"module": "builtins",
"kind": "int"
},
"comparable": true,
// iff strategy is 'repr'
"value": "1",
// iff strategy is 'list' or 'dict'
"items": ["3", "2"],
// iff strategy = 'reduce'
"constructor": "mymod.A.__new__",
"args": ["mymod.A"],
"state": {"a": "4", "b": "5"},
"listitems": ["7", "8"],
"dictitems": {"ka": "10"}
}
}
}
GitHub repository
FAQs
Unknown package
We found that utbot-executor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.