
Research
PyPI Package Disguised as Instagram Growth Tool Harvests User Credentials
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Client library for the User Management App API
gem 'user_management_api', git: 'git@github.umn.edu:mpc/user_management_api.git', tag: 'v0.0.15'
There are four ways to configure the gem, and they can be used interchangeably.
In config/application.rb or config/environments/.rb
config.user_management_api.KEY = VALUE
In config/initializers/mpc_shib_auth.rb
UserManagementApi::Config.configure do |config|
config.KEY = VALUE
end
From anywhere
UserManagementApi::Config.KEY = VALUE
Any configuration can be overridden by passing values into the constructor:
UserManagementApi::Client.new('http://someserver.com', '111-TOKEN-0000')
Base URL of the target User Management App. Should not include any path information. Ex: http://localhost:3000
Access token used in all requests made to the API
Provided the base_uri and token have been configured, a client can be created without any constructor parameters: UserManagementApi::Client.new
user_registrations(unique_id)
user_registration(project, unique_id)
search_registrations(project, criteria = {})
set_registration_custom_attributes(project, unique_id, attributes)
create_account_url(project, return_url = nil)
- Create new user account with project registrationcreate_registration_url(project, return_url = nil)
- Create new registration for existing, logged in useredit_registration_url(project, return_url = nil)
- Edit existing registration for logged in userrenew_registration_url(project = nil, return_url = nil)
- Renew all registrations for given user (with brand of optional project)forgot_password_url
change_password_url(return_url = nil)
owned_registration_groups(project, user_unique_id)
enrolled_registration_groups(project, user_unique_id)
users_by_email(emails)
user(unique_id)
create_user(user)
update_user(user)
FAQs
Unknown package
We found that user_management_api demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
A deceptive PyPI package posing as an Instagram growth tool collects user credentials and sends them to third-party bot services.
Product
Socket now supports pylock.toml, enabling secure, reproducible Python builds with advanced scanning and full alignment with PEP 751's new standard.
Security News
Research
Socket uncovered two npm packages that register hidden HTTP endpoints to delete all files on command.