Python Malware Starting to Employ Anti-Debug Techniques

• pyodide

  67 11,397 9.7 Python

  Pyodide is a Python distribution for the browser and Node.js based on WebAssembly

  

https://github.com/pyodide/pyodide/issues/795#issuecomment-1...

What does it mean for a package to have been signed with the key granted to the CI build server?

Does a Release Manager (or primary maintainer) again sign what the build farm produced once? What sort of consensus on PR approval and build output justifies use of the build artifact signing key granted to a CI build server?

How open are the build farm and signed package repo and pubkey server configurations? https://github.com/dev-sec

• CPython

  1,314 59,531 10.0 Python

  The Python programming language

  

that doesn't make much sense and there are necessary uses for eval() /exec(), mostly for dynamic creation of code:

For example here's Python dataclasses in the standard library using exec() to create the `__init__` and other methods that go on your dataclass:

https://github.com/python/cpython/blob/main/Lib/dataclasses....

Here's Pydantic using it for a jupyter notebook check:

https://github.com/pydantic/pydantic/blob/594effa279668bd955...

here's Pytest using it to rewrite modules so that functions like assert etc. are instrumented by pytest:

https://github.com/pytest-dev/pytest/blob/eca93db05b6c5ec101...

Here's the decorator module using it (as is the only way to do this in Python) to create a signature matching decorator for an arbitrary function:

https://github.com/micheles/decorator/blob/ad013a2c1ad796996...

All of these libraries are completely secure as eval/exec are used with code fragments that are generated by the libraries, not based on untrusted input.

eval() /exec() are not running executable files, just Python code, the same way all the rest of the package is already doing.

• WorkOS

  workos.com sponsored

  The modern identity platform for B2B SaaS. The APIs are flexible and easy-to-use, supporting authentication, user identity, and complex enterprise features like SSO and SCIM provisioning.

  

• pydantic

  167 18,617 9.8 Python

  Data validation using Python type hints

  

that doesn't make much sense and there are necessary uses for eval() /exec(), mostly for dynamic creation of code:

For example here's Python dataclasses in the standard library using exec() to create the `__init__` and other methods that go on your dataclass:

https://github.com/python/cpython/blob/main/Lib/dataclasses....

Here's Pydantic using it for a jupyter notebook check:

https://github.com/pydantic/pydantic/blob/594effa279668bd955...

here's Pytest using it to rewrite modules so that functions like assert etc. are instrumented by pytest:

https://github.com/pytest-dev/pytest/blob/eca93db05b6c5ec101...

Here's the decorator module using it (as is the only way to do this in Python) to create a signature matching decorator for an arbitrary function:

https://github.com/micheles/decorator/blob/ad013a2c1ad796996...

All of these libraries are completely secure as eval/exec are used with code fragments that are generated by the libraries, not based on untrusted input.

eval() /exec() are not running executable files, just Python code, the same way all the rest of the package is already doing.

• pytest

  30 11,349 9.8 Python

  The pytest framework makes it easy to write small tests, yet scales to support complex functional testing

  

that doesn't make much sense and there are necessary uses for eval() /exec(), mostly for dynamic creation of code:

For example here's Python dataclasses in the standard library using exec() to create the `__init__` and other methods that go on your dataclass:

https://github.com/python/cpython/blob/main/Lib/dataclasses....

Here's Pydantic using it for a jupyter notebook check:

https://github.com/pydantic/pydantic/blob/594effa279668bd955...

here's Pytest using it to rewrite modules so that functions like assert etc. are instrumented by pytest:

https://github.com/pytest-dev/pytest/blob/eca93db05b6c5ec101...

Here's the decorator module using it (as is the only way to do this in Python) to create a signature matching decorator for an arbitrary function:

https://github.com/micheles/decorator/blob/ad013a2c1ad796996...

All of these libraries are completely secure as eval/exec are used with code fragments that are generated by the libraries, not based on untrusted input.

eval() /exec() are not running executable files, just Python code, the same way all the rest of the package is already doing.

• decorator

  1 811 3.5 Python

  decorator (by micheles)

that doesn't make much sense and there are necessary uses for eval() /exec(), mostly for dynamic creation of code:

For example here's Python dataclasses in the standard library using exec() to create the `__init__` and other methods that go on your dataclass:

https://github.com/python/cpython/blob/main/Lib/dataclasses....

Here's Pydantic using it for a jupyter notebook check:

https://github.com/pydantic/pydantic/blob/594effa279668bd955...

here's Pytest using it to rewrite modules so that functions like assert etc. are instrumented by pytest:

https://github.com/pytest-dev/pytest/blob/eca93db05b6c5ec101...

Here's the decorator module using it (as is the only way to do this in Python) to create a signature matching decorator for an arbitrary function:

https://github.com/micheles/decorator/blob/ad013a2c1ad796996...

All of these libraries are completely secure as eval/exec are used with code fragments that are generated by the libraries, not based on untrusted input.

eval() /exec() are not running executable files, just Python code, the same way all the rest of the package is already doing.

• thonny

  176 2,867 9.5 Python

  Python IDE for beginners

  

https://conda-forge.org/docs/maintainer/adding_pkgs.html#run...

From https://github.com/thonny/thonny/issues/2181 :

> * https://conda-forge.org/docs/maintainer/updating_pkgs.html

> Pushing to regro-cf-autotick-bot branch¶ When a new version of a package is released on PyPI/CRAN/.., we have a bot that automatically creates version updates for the feedstock. In most cases you can simply merge this PR and it should include all changes. When certain things have changed upstream, e.g. the dependencies, you will still have to do changes to the created PR. As feedstock maintainer, you don’t have to create a new PR for that but can simply push to the branch the bot created. There are two alternatives […]

nektos/act is one way to run a github-actions.yml build definition locally; without CI (e.g. GitLab Runner, which requires ~--privileged access to the docker/Podman socket) to check whether you get the exact same build artifacts as the CI build farm

• act

  145 50,182 9.2 Go

  Run your GitHub Actions locally 🚀

  

https://github.com/nektos/act

Are there guidelines for excluding entropy like the commit hash and build time so that the artifact hashes are exactly the same; are reproducible on my machine, too?

• InfluxDB

  www.influxdata.com sponsored

  Power Real-Time Data Analytics at Scale. Get real-time insights from all types of time series data with InfluxDB. Ingest, query, and analyze billions of data points in real-time with unbounded cardinality.

  

Suggest a related project