gh-action-pypi-publish
guarddog
gh-action-pypi-publish | guarddog | |
---|---|---|
5 | 6 | |
844 | 493 | |
2.6% | 3.2% | |
8.1 | 9.1 | |
1 day ago | 3 days ago | |
Python | Python | |
BSD 3-clause "New" or "Revised" License | Apache License 2.0 |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
gh-action-pypi-publish
-
PyPI new user and new project registrations temporarily suspended
> Recently I've seen someone on Reddit trying to automate the creation of PyPI projects through GitHub Actions. The person was complaining that the first deployment couldn't use an API key for that project since it didn't exist. So I'm not surprised some people are trying to do the same for malicious purposes.
Sorry for the tangent, but: you can do this now! If you use trusted publishing, you can register a "pending publisher" for a project that doesn't exist yet. When the trusted publisher (like GitHub Actions) is used, it'll create the project[1].
All of this is supported transparently by the official publishing action for GitHub Actions[2].
[1]: https://docs.pypi.org/trusted-publishers/creating-a-project-...
[2]: https://github.com/pypa/gh-action-pypi-publish
-
Publishing to PyPI via GitHub Action
In the documentation example, I see that the action yaml file contains the line uses: pypa/gh-action-pypi-publish@release/v1. I have never done this before and almost went with that, but I am not sure why the example shows v1 hardcoded, so I don't think I actually want this to happen. It doesn't seem to be well explained though, and the pypi-publish action repo was also quiet on this. Is this saying that it will create a release branch in my repo and call the release v1? Or how will this appear after I've done it? Will I have to manually change this v1 to v0.1.1 in the actions file AND the pyproject.toml?
-
"Even with --dry-run pip will execute arbitrary code found in the package's setup.py. In fact, merely asking pip to download a package can execute arbitrary code"
Yeah, you're uploading to PyPi in your pipeline, great. The custom github action still uses twine because the stdlib falls short on BASIC security. https://github.com/pypa/gh-action-pypi-publish/blob/unstable/v1/twine-upload.sh
-
Do you publish pypi source code to Github as well in the same form?
I never bothered with pypi myself but I hope the nudge into github actions helps you. I've found the following promising github action: https://github.com/pypa/gh-action-pypi-publish
- The Python Package Index is now a GitHub secret scanning integrator
guarddog
-
'everything' blocks devs from removing their own NPM packages
Yes. https://securitylabs.datadoghq.com/articles/guarddog-identif....
-
A Tale of Two Kitchens - Hypermodernizing Your Python Code Base
GuardDog is a CLI tool that allows to identify malicious PyPI packages.
-
PyPI new user and new project registrations temporarily suspended
I've been very cautious the last couple of years due to these bad actors when looking at packages that might suit my needs. If there is no online presence of the source code (git anything, zips/gzs, etc), multiple packages submitted in a short time frame, or a greater than normal amount, an/or a derivation/plugin of a popular package it's usually a no-go.
For those that I do possibly trust, I then download the package (pip download) and review it. Doing a quick regex for URLs or exec() calls helps, but I probably should use something like guarddog (https://github.com/DataDog/guarddog)
-
451 PyPI packages install Chrome extensions to steal crypto
I woul not use a freeVPN service, honestly. Anyway, you could try to check the code or help with some stuff like this: https://securitylabs.datadoghq.com/articles/guarddog-identify-malicious-pypi-packages/ .
- Finding malicious PyPI packages through static code analysis: Meet GuardDog
- Identify malicious PyPI packages using static analysis and metadata heuristics
What are some alternatives?
build - A simple, correct Python build frontend
pypi-command-line - A powerful, colorful, beautiful command-line-interface for pypi.org
git-filter-repo - Quickly rewrite git repository history (filter-branch replacement)
AudioBook - Listen to Pdf/Rtf/txt/docs/epub/mobi/odt book with just a few line of Python code. Leave a :star: if you like It.
amplify-preview-actions - This action deploys your AWS Amplify pull request preview for your public repository
zeplyn - zeplyn makes package publishing quick and easy so you can reiterate faster
git-repo-sync - Git Repo Sync enables you to synchronize code to other code management platforms, such as GitLab, Gitee, etc.
TheAlgorithms - All Algorithms implemented in Python
trufflehog - Find and verify secrets
starcli - :sparkles: Browse trending GitHub projects from your command line
release - Contains every things needed to release jenkins core from the jenkins infra project
malicious-software-packages-dataset - An open-source dataset of malicious software packages found in the wild, 100% vetted by humans.