Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The YoWASP nextpnr suite of packages provides nextpnr and related tools for several FPGA families built for WebAssembly. See the overview of the YoWASP project for details.
The supported FPGA families are:
For technical reasons, the ecppack
, ecpunpack
, ecpbram
, ecppll
, and ecpmulti
tools from the MachXO2 toolchain shipped in the yowasp-nextpnr-machxo2
PyPI package are installed under the names yowasp-xo2pack
, yowasp-xo2unpack
, yowasp-xo2bram
, yowasp-xo2pll
, and yowasp-xo2multi
respectively. These commands run bit-for-bit identical code as their yowasp-ecp*
prefixed brethren from the yowasp-nextpnr-ecp5
PyPI package of the same version.
The version of this package is derived from the upstream nextpnr package version in the X.Y[.Z]
format, and is comprised of five or six parts in a X.Y.Z.N.postM[.dev]
format:
X
: nextpnr major versionY
: nextpnr minor versionZ
: nextpnr patch version; reserved as nextpnr currently does not do patch releasesN
: zero for packages built from nextpnr releases, N
for packages built from unreleased nextpnr snapshots; N
is the amount of commits since the latest releasepostM
: package build version; disambiguates different builds produced from the same nextpnr source treedev
: present only for packages built from unreleased nextpnr snapshots; marks these packages as pre-releasesWith this scheme, there is a direct correspondence between upstream versions and PEP 440 Python package versions. Packages built from unreleased snapshots are ignored by pip by default, but can be still installed explicitly. (These packages are uploaded daily to TestPyPI, but only occasionally to PyPI.)
A different versioning scheme was used earlier, where the package build version was denoted by a .devM
suffix. This scheme did not work well with PEP 440 version specifiers and was retired.
See the documentation for yowasp-runtime.
This package is covered by the ISC license, which is the same as the nextpnr license.
FAQs
nextpnr-ecp5 FPGA place and route tool
We found that yowasp-nextpnr-ecp5 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.