
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
The YoWASP nextpnr suite of packages provides nextpnr and related tools for several FPGA families built for WebAssembly. See the overview of the YoWASP project for details.
The supported FPGA families are:
For technical reasons, the ecppack
, ecpunpack
, ecpbram
, ecppll
, and ecpmulti
tools from the MachXO2 toolchain shipped in the yowasp-nextpnr-machxo2
PyPI package are installed under the names yowasp-xo2pack
, yowasp-xo2unpack
, yowasp-xo2bram
, yowasp-xo2pll
, and yowasp-xo2multi
respectively. These commands run bit-for-bit identical code as their yowasp-ecp*
prefixed brethren from the yowasp-nextpnr-ecp5
PyPI package of the same version.
The version of this package is derived from the upstream nextpnr package version in the X.Y[.Z]
format, and is comprised of five or six parts in a X.Y.Z.N.postM[.dev]
format:
X
: nextpnr major versionY
: nextpnr minor versionZ
: nextpnr patch version; reserved as nextpnr currently does not do patch releasesN
: zero for packages built from nextpnr releases, N
for packages built from unreleased nextpnr snapshots; N
is the amount of commits since the latest releasepostM
: package build version; disambiguates different builds produced from the same nextpnr source treedev
: present only for packages built from unreleased nextpnr snapshots; marks these packages as pre-releasesWith this scheme, there is a direct correspondence between upstream versions and PEP 440 Python package versions. Packages built from unreleased snapshots are ignored by pip by default, but can be still installed explicitly. (These packages are uploaded daily to TestPyPI, but only occasionally to PyPI.)
A different versioning scheme was used earlier, where the package build version was denoted by a .devM
suffix. This scheme did not work well with PEP 440 version specifiers and was retired.
See the documentation for yowasp-runtime.
This package is covered by the ISC license, which is the same as the nextpnr license.
FAQs
nextpnr-ecp5 FPGA place and route tool
We found that yowasp-nextpnr-ecp5 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.