
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
zsl
Advanced tools
ZSL is a Python micro-framework utilizing dependency injection for creating service applications on top of Flask web framework and Gearman job server or Celery task queue.
We developed ZSL to modernize our workflow with maintaining our clients' mostly web applications written in various older CMS solutions without the need to rewrite them significantly. With ZSL we can write our new components in Python, with one coherent shared codebase, accessible trough Gearman or JavaScript. Also the same code can be called through various endpoints - web or task queue nowadays.
At current stage this should be taken as proof of concept. We don't recommend to run in any production except ours. It is too rigid, with minimum test coverage and lots of bad code practices. We open sourced it as way of motivation for us to make it better.
We recommend to install it trough PyPi and run it in a virtualenv or docker container.
$ pip install zsl
For now it is a bit cumbersome to get it running. It has inherited settings trough ENV variables from Flask and has a rigid directory structure like django apps. On top of that, it needs a database and Redis.
The minimum application layout has to contain:
.
├── app # application sources
│ ├── __init__.py
│ └── tasks # public tasks
│ ├── hello.py
│ └── __init__.py
├── settings # settings
│ ├── app_settings.cfg
│ ├── default_settings.py
│ └── __init__.py
└── tests
$ export ZSL_SETTINGS=`pwd`/settings/app_settings.cfg
# settings/app_settings.cfg
TASKS = TaskConfiguration()\
.create_namespace('task')\
.add_packages(['app.tasks'])\
.get_configuration()
RESOURCE_PACKAGE = ()
DATABASE_URI = 'postgresql://postgres:postgres@localhost/postgres'
DATABASE_ENGINE_PROPS = {}
SERVICE_INJECTION = ()
REDIS = {
'host': 'localhost',
'port': 6379,
'db': 0
}
RELOAD = True
# hello.py
class HelloWorldTask:
def perform(self, data):
return "Hello World"
$ python -m zsl web
* Running on http://127.0.0.1:5000/ (Press CTRL+C to quit)
$ curl http://localhost:5000/task/hello/hello_world_task
Hello world!
Deploy will happen upon pushing a new tag to Gitlab.
Use bump2version to update version in config files. It will also create commit and new tag.
$ bumpversion --new-version ${VERSION} {major|minor|patch} --tag-name ${VERSION}
Version name uses semver. Starts with number.
Current pipeline tries to copy previous Travis runs. It runs tox target seperately and on a tag push will create deploy.
Gitlab pipeline runs inside a docker image which is defined in docker/Dockerfile.tox. Currently we manually configure, build and push it to gitlab container registry. So to update the container follow this steps.
When pushing for the first time run, you have to create an access token and login to atteq gitlab container registry. Go to https://gitlab.atteq.com/atteq/z-service-layer/zsl/-/settings/access_tokens and create a token to read/write to registry. Then run
docker login registry.gitlab.atteq.com:443
To build/push the image:
Build image locally.
docker build -t zsl/tox-env -f docker/Dockerfile.tox .
Tag image.
docker tag zsl/tox-env registry.gitlab.atteq.com:443/atteq/z-service-layer/zsl/tox-env:latest
Push image.
docker push registry.gitlab.atteq.com:443/atteq/z-service-layer/zsl/tox-env:latest
Update image hash in .gitlab-ci.yml. (copy from build output or docker images --digests).
FAQs
zsl application framework for web based services
We found that zsl demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.