jf--- / compas_dev_env

create a development environment for the compas eco system

compas_env

some scripts that help to setup a compas development environment

• developer focussed

  • forks the repos such to be able to create pull requests conveniently

    • you need to edit the .env file or have a GITHUB_TOKEN stuffed in your environment variables
    • only when there are no changes staged

  • modules are installed with a developer install eg pip install -e . such that changes to the source are reflected in the environment

• complete

  • all known modules are installed

• convenient

  • installs the python modules with the Rhino environment, in such a way that code changes are reflected

TODO

• rebase a repo from origin when dealing with a forked repo
• actually install modules in Rhino's python path
  • incl RhinoWIP support
  • Rhino-stubs for proper type completion
• conda package for libigl exists on the freecad channel, but old and linux only

compas_dev_env's Issues

Deleted dependency detected

I'm a Cyber Security researcher and developer of PackjGuard [1] to address open-source software supply chain attacks.

Issue

During my research, I found that this repo is vulnerable to attack due to deleted dependency from the public PyPI registry.

Details

Specifically, file https://github.com/jf---/compas_dev_env/blob/fe2577d5fa3f9d21aaa2e8521f2dad2fbba30507/requirements.txt lists er-stubs as one of the dependencies. However, it has been deleted from public PyPI. As such, an external bad actor can claim that name and register a malicious package, which will be then installed with pip install command, resulting in arbitrary remote code execution.

Impact

Not only your apps/services using https://github.com/jf---/compas_dev_env repo code are vulnerable to this attack, but the users of your open-source Github repo could also fall victim.

You could read more about such attacks here: https://medium.com/@alex.birsan/dependency-confusion-4a5d60fec610

Remediation

Please manually register a placeholder er-stubs package on PyPI immediately or remove er-stubs dependency from https://github.com/jf---/compas_dev_env/blob/fe2577d5fa3f9d21aaa2e8521f2dad2fbba30507/requirements.txt to fix this vulnerability.

To automatically fix such issues in future, please install PackjGuard Github app [1].

Thanks!

1. PackjGuard is a Github app that monitors your repos 24x7, detects vulnerable/malicious/risky open-source dependencies, and creates pull requests for auto remediation: https://github.com/marketplace/packjguard