Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
This is a rewrite of Walter Korman's shaper@fatgoose.com yahoo-weather gem.
The aim of this port/rewrite is to add proper specs, better test-coverage and active maintenance. I have ported much of Walter's original intent and LICENSE, and thank him for his contribution. My initial motivation is to send Prowl notifications to my iPad, iPhone, iPod whenever hazardous weather is coming.
Yweather provides an object-oriented Ruby interface to the Yahoo! Weather XML RSS feed detailed at http://developer.yahoo.com/weather.
People care a lot about the weather. This may seem ironic given they can just glance out the window. However, we can all understand a fascination with details and forecasting.
Log the weather information to your database! Graph it to your heart's content! Write a widget that emails the weather to your cell phone every five minutes with a link to your friend's PayPal account to deposit money if the weather's sunny and you both bet that it would be rainy. And the fun doesn't have to stop there.
Source code is at http://github.com/midwire/yweather.
NOTE: This library was updated as of December 2009 to use a new WOEID-based lookup interface. Yahoo has deprecated the older non-WOEID-based lookup API. The archived page with the deprecated API details is at:
http://developer.yahoo.com/weather/archive.html
gem install yweather
A simple example program:
#!/usr/bin/env ruby
require "yweather"
require "colorize"
zipcode = ARGV.shift
if zipcode.nil?
puts ">>> Usage: yweather zipcode"
exit
end
client = Yweather::Client.new
response = client.get_response_for_zipcode(zipcode)
# TODO: Use a ~/.yweather YAML file to determine format of output
print <<edoc
#{response.title.yellow}
#{response.condition.temp} degrees
#{response.condition.text}
edoc
puts "Wind:".yellow
response.wind_conditions.each_pair do |key, value|
puts " #{key}: #{value}"
end
puts "Atmosphere:".yellow
response.atmospheric_conditions.each_pair do |key, value|
puts " #{key}: #{value}"
end
Produces output as:
Conditions for Beverly Hills, CA at 10:51 am PST
61 degrees
Fair
Wind:
chill: 61°
direction: 0°
speed: 0 mph
Atmosphere:
humidity: 23%
visibility: 10 mi
pressure: steady at 30.18in
There is a variety of detailed weather information in other attributes of the Yweather::Response object.
This library is provided via the GNU LGPL license at http://www.gnu.org/licenses/lgpl.html.
Copyright 2006 - 2009, Walter Korman shaper@fatgoose.com, http://lemurware.blogspot.com.
Copyright 2012, Chris Blackburn <chris you-know-what-goes-here m and-here blackburn@gmail and-here com>, http://midwire.github.com
Thanks to Walter Korman for the initial hack.
Pull requests are appreciated. Please use feature/branches or hotfix/branches and add specs for your changes.
FAQs
Unknown package
We found that yweather demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.