Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Forget about setting up your own infrastructure, vps, network, orchestrators, etc... go serverless
$ pip install yappa -U
$ pip freeze > requirements.txt
$ yappa setup
$ yappa deploy
...that's it! Your application is deployed
when your code is updated just run
$ yappa deploy
Both WSGI and ASGI applications are supported (as well as raw functions). So Django, Flask, FastAPI... etc could be easily deployed.
Furthermore, not just regular json API could be deployed this way. Several types of applications could be launched with Yappa:
please see examples:
django manage.py commands are supported. just run
$ yappa manage migrate
In order to support management commands, for Django projects second cloud function is being created every deploy. It's made only for handling management commands, and it's not public. Therefore, commands do not support user inputs: to every command '--no-input' flag is added.
As of Django 3.0 env variables are supported for createsuperuser command. So you should deploy your app with DJANGO_SUPERUSER_USERNAME, DJANGO_SUPERUSER_PASSWORD environment variables. Then run
$ yappa manage createsuperuser
The other way around would be to implement custom management command (see StackOverflow topic)
Command '$ yappa setup' prompts you for OAuth token. Then, Yappa creates service account "yappa-uploader-service" with roles editor and serverless.functions.admin for the specified folder. Key for this account is created and saved locally at .yc file.
Command '$ yappa deploy' supports two types of authorization
There are some limitations, however YandexCloud team is constantly releasing new features and services. Also, the team of this project will try to keep up. So stay tuned :)
Managed Postgres and YandexDB is supported inside Yandex Cloud. In case any other DB - it has to have public IP address
For details on how te set up connection with managed postgres please refer to
Please note that some request headers (like Authorization) are deleted before function is invoked
Habr:
Please see project boards and issues. With any questions and suggestions please visit our telegram chat
In the near future we will be focused on documentation improvements (mainly deployment examples) and support of async tasks (serverless workers and scheduler for celery).
FAQs
Easy serverless deploy of python web applications
We found that yappa demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.