Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A Python application for tracking, reporting on timing and complexity in tests and applications.
A command-line application for tracking, reporting on complexity of Python tests and applications.
wily [a]:
quick to think of things, having a very good understanding of situations and possibilities,
and often willing to use tricks to achieve an aim.
Wily uses git to go through each revision (commit) in a branch and run complexity and code-analysis metrics over the code. You can use this to limit your code or report on trends for complexity, length etc.
Wily can be installed via pip from Python 3.6 and above:
$ pip install wily
Alternatively, Wily packages are available on conda-forge:
$ conda install -c conda-forge wily
See the Documentation Site for full usage guides.
Wily can be used via a command line interface, wily
.
$ wily --help
Here is a demo of wily analysing a Python project, giving a summary of changes to complexity in the last 10 commits and then showing changes against a specific git revision:
Wily can be used in a CI/CD workflow to compare the complexity of the current files against a particular revision.
By default, wily will compare against the previous revision (for a git-pre-commit hook) but you can also give a Git ref, for example HEAD^1
is the commit before the HEAD reference.
$ wily build src/
$ wily diff src/ -r HEAD^1
Or, to compare against
$ wily build src/
$ wily diff src/ -r master
You can install wily as a pre-commit plugin by adding the following to .pre-commit-config.yaml
repos:
- repo: local
hooks:
- id: wily
name: wily
entry: wily diff
verbose: true
language: python
additional_dependencies: [wily]
wily build
The first step to using wily
is to build a wily cache with the statistics of your project.
Usage: __main__.py build [OPTIONS] [TARGETS]...
Build the wily cache
Options:
-n, --max-revisions INTEGER The maximum number of historical commits to
archive
-o, --operators TEXT List of operators, separated by commas
--help Show this message and exit.
By default, wily will assume your project folder is a git
directory. Wily will not build a cache if the working copy is dirty (has changed files not committed).
$ wily build src/
Limit the number of revisions (defaults to 50).
wily report
Show a specific metric for a given file, requires that .wily/
exists
wily report
will print the metric and the delta between each revision.
wily rank
Show the ranking for all files in a directory or a single file based on the metric provided, requires that .wily/
exists
wily rank
will print a table of files and their metric values.
wily graph
Similar to wily report
but instead of printing in the console, wily
will print a graph in a browser.
wily index
Show information about the build directory. Requires that .wily/
exists.
wily index
will print the configuration to the screen and list all revisions that have been analysed and the operators used.
wily list-metrics
List the metrics available in the Wily operators. Each one of the metrics can be used in wily graph
and wily report
$ wily list-metrics
mccabe operator:
No metrics available
raw operator:
╒═════════════════╤══════════════════════╤═══════════════╤══════════════════════════╕
│ │ Name │ Description │ Type │
╞═════════════════╪══════════════════════╪═══════════════╪══════════════════════════╡
│ loc │ Lines of Code │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ lloc │ L Lines of Code │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ sloc │ S Lines of Code │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ comments │ Multi-line comments │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ multi │ Multi lines │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ blank │ blank lines │ <class 'int'> │ MetricType.Informational │
├─────────────────┼──────────────────────┼───────────────┼──────────────────────────┤
│ single_comments │ Single comment lines │ <class 'int'> │ MetricType.Informational │
╘═════════════════╧══════════════════════╧═══════════════╧══════════════════════════╛
cyclomatic operator:
No metrics available
maintainability operator:
╒══════╤═════════════════════════╤═════════════════╤══════════════════════════╕
│ │ Name │ Description │ Type │
╞══════╪═════════════════════════╪═════════════════╪══════════════════════════╡
│ rank │ Maintainability Ranking │ <class 'str'> │ MetricType.Informational │
├──────┼─────────────────────────┼─────────────────┼──────────────────────────┤
│ mi │ Maintainability Index │ <class 'float'> │ MetricType.AimLow │
╘══════╧═════════════════════════╧═════════════════╧══════════════════════════╛
You can put a wily.cfg
file in your project directory and wily
will override the runtime settings. Here are the available options:
[wily]
# list of operators, choose from cyclomatic, maintainability, mccabe and raw
operators = cyclomatic,raw
# archiver to use, defaults to git
archiver = git
# path to analyse, defaults to .
path = /path/to/target
# max revisions to archive, defaults to 50
max_revisions = 20
You can also override the path to the configuration with the --config
flag on the command-line.
Wily will detect and scan all Python code in .ipynb files automatically.
You can disable this behaviour if you require by setting ipynb_support = false
in the configuration.
You can also disable the behaviour of reporting on individual cells by setting ipynb_cells = false
.
"cute animal doing dabbing" Designed by Freepik
FAQs
A Python application for tracking, reporting on timing and complexity in tests and applications.
We found that wily demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.