Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
High level utilities for a subset of boto3 operations common for AWS serverless development in Python.
xoto3
(pronounced zoto-three) is a layer of useful micro-utilities
for boto3
(the AWS Python library) particularly suitable for
serverless development.
These come from years of experience developing a serverless platform at XOi Technologies, and represent real production code.
Some of the features included:
A more general purpose boto3
client API paginator.
Higher-level abstractions for DynamoDB, including:
boto3
and DynamoDB itself.Cloudwatch Insights and Log Groups Query URL formatters.
General-purpose AWS Lambda finalization code, to make sure buffered IO gets a chance to flush before your Lambda gets paused.
Wrapper for SSM parameter puts and gets, including built-in support for parameter values larger than what SSM will accept by automatically splitting your values and reconstructing them on gets.
Various other utilities are included as well - feel free to poke through the source code.
None of these features "rely" on any of the others, so all of the
power is left in your hands. This is not a framework; just a set of
mostly pure-functional utilities, with a couple of handy wrappers for
boto3
functions that perform IO.
Some fairly general-purpose utilities are also included. See the readme for more details.
Some highlights:
tree_map
- recursively map through a tree of Python builtinslazy
- general purpose lazy-loading containerpipe_multiprocessing
- a Process Pool for places like AWS Lambda
where Python's built-in shared memory-dependent Pool does not work.You can run all unit tests with pipenv run pytest tests
.
You can additionally include all the DynamoDB integration tests by setting some environment variables:
XOTO3_INTEGRATION_TEST_DYNAMODB_ID_TABLE_NAME
: the name of a
DynamoDB table with a primary key that is a partition key of id
and no range key.
XOTO3_INTEGRATION_TEST_NO_RANGE_KEY_INDEX_HASH_KEY
: the name of an
attribute which is the partition key of a GSI with no range key.
If you don't currently have a table viable for testing, you can use the following script to easily create one:
pipenv run python ./scripts/create_integration_test_table.py
Any new changes should be accompanied by unit tests. Integration tests should also be included where they are helpful.
Integration tests should make use of environment variables and pytest's ability to skip a test in the event that an environment variable is not set.
Additionally, pytest is configured to run all tests in parallel, so any integration test you write must be independent of any other test, and must not leave behind test data.
Your integration tests should be written alongside the unit tests. We do not keep them in a separate folder.
FAQs
High level utilities for a subset of boto3 operations common for AWS serverless development in Python.
We found that xoto3 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.