The Dependency Injector is a mature, feature-rich dependency injection framework for Python. It provides core DI patterns through providers (Factory, Singleton, Resource, etc.), containers (Declarative/Dynamic), and wiring mechanisms (@inject decorator). The framework emphasizes explicit dependency declaration, testability, and loose coupling while supporting async/await, configuration management from multiple sources, and runtime provider overriding. It includes framework-specific integrations (Flask, Django, FastAPI, etc.) via its wiring module and extension system, though the core remains framework-agnostic. Architecturally, the codebase separates concerns into distinct modules: providers handle object creation/lifecycle, containers manage provider resolution and hierarchy, wiring enables automatic dependency injection into functions/methods, resources manage lifecycle-dependent objects (e.g., DB connections), and configuration providers unify settings from YAML/INI/JSON/env. The framework uses Cython for performance-critical components while maintaining a pure Python interface. Comprehensive documentation, extensive test suite, and numerous examples demonstrate practical integration patterns across web applications, daemons, and cloud services. The project shows strong maintenance with frequent releases, active issue triage, and broad Python version support (3.8-3.14). Technical drift is low due to proactive dependency updates, removal of deprecated Python versions, and adherence to modern Python practices. The codebase exhibits high craftsmanship in its provider patterns, particularly the Resource provider's context-manager semantics and the wiring module's automatic dependency resolution, making it a reusable dependency injection solution for Python applications.
IntelOwl is a production-grade, open-source threat intelligence platform that automates the analysis of observables (IPs, domains, URLs, hashes) and files (PE, PDF, APK, etc.) through a pluggable plugin system. The backend is built with Django REST Framework, Celery for asynchronous task execution, and Django Channels for real-time WebSocket updates. The frontend is a React single-page application using react-router, react-flow for pipeline visualizations, and Zustand for state management. The system supports multi-tenancy, organizations, role-based access, and integrates with dozens of external threat intelligence APIs and open-source analysis tools via containerized microservices. The architecture is centered around a plugin framework with five plugin types: analyzers (file and observable), connectors (push results to external systems), visualizers (render reports), pivots (create child jobs from analysis results), and ingestors (pull threat feeds). Playbooks bundle these plugins into repeatable analysis workflows. A data model manager normalizes analyzer outputs into structured evaluations with reliability scores, and a user event system allows manual verdict overrides with decay logic. The platform also includes an AI chatbot assistant powered by a local Ollama LLM and LangGraph, enabling natural-language queries and one-click analysis launches. Key operational features include a comprehensive REST API, token-based authentication with optional OAuth/LDAP/RADIUS, Elasticsearch for BI reporting, and Docker-based deployment with separate containers for specialized analyzers. The codebase is actively maintained with extensive unit and integration tests, CI/CD pipelines, and a large community (4695 stars). While the migration system is somewhat repetitive, the overall architecture is clean, modular, and demonstrates strong software engineering practices.
This repository is a curated collection of threat intelligence indicators of compromise (IOCs) published by ESET Research. It contains structured data for hundreds of malware families and APT campaigns, including file hashes (MD5, SHA1, SHA256), network indicators (domains, IPs, URLs), host-based artifacts (registry keys, file paths, mutexes), and detection rules (YARA, Sigma, Snort). The data is organized per-threat in consistent directory structures with README.adoc documentation, MISP event JSON exports, and plain hash lists. The repository serves as a reference for threat hunters, SOC analysts, and security researchers to detect and investigate known threats. While the data is static and time-sensitive, the detection rules and structured IOC formats are directly reusable in security tools and platforms.
Splat is a cross-platform .NET utility library that provides a lean abstraction layer for dependency injection (service location), logging, bitmap loading, color handling, and application performance monitoring. It is part of the ReactiveUI ecosystem and is designed to work across .NET Framework, .NET Core, Xamarin, and modern .NET (including NativeAOT). The library offers multiple DI container adapters (Autofac, DryIoc, Ninject, SimpleInjector, Microsoft.Extensions.DependencyInjection), logging backends (Serilog, NLog, Log4Net, Microsoft.Extensions.Logging, Exceptionless), and bitmap loaders (SkiaSharp, WPF, Android native, Cocoa). The core service location includes several resolver implementations with different performance characteristics, including a modern lock-free generic-first resolver optimized for AOT. The logging abstraction supports allocation-free typed arguments and composable wrappers. While the library is well-tested and actively maintained, some adapter packages are marked as alpha/prototype and a few components rely on reflection or platform-specific code that may drift.
GreedyBear is a threat intelligence platform that consumes honeypot logs from T-Pot clusters (Cowrie, Heralding, Tanner, etc.), extracts Indicators of Compromise (IOCs), enriches them with external threat feeds (ThreatFox, AbuseIPDB, FireHol, Spamhaus, MalwareBazaar), and applies machine learning scoring (Random Forest) to predict recurrence probability and expected interactions. The system exposes public and authenticated APIs in multiple formats (JSON, NDJSON, CSV, TXT, STIX 2.1) for threat researchers and supports event ingestion from external sensors. The backend is built with Django/DRF, PostgreSQL, and Elasticsearch, orchestrated via Django-Q cronjobs for scheduled extraction, enrichment, and cleanup. A React SPA frontend provides a customizable dashboard with attack maps, trending attackers, and feed browsing. The architecture uses repository, strategy, and factory patterns, with a clean separation between extraction pipelines, scoring, and API layers. While primarily an application, it has strong data engineering components—ETL pipelines, ML scoring, clustering (MinHash LSH for command sequences), and data enrichment—making it a hybrid that leans application.
This repository is a Node.js/TypeScript library for dependency injection (DI), heavily inspired by Symfony's DI container. It provides a service container that manages object construction, autowiring (automatic dependency resolution from constructor parameter types), and service configuration via YAML, JSON, JavaScript, and XML files. The library supports advanced features such as compiler passes, service decoration, tagged and keyed services, conditional service registration, lazy loading, and graph export. It includes a CLI tool for generating configurations and inspecting the container. The architecture follows a modular design: a ContainerBuilder manages definitions and compilation, loaders parse configuration files, and a compiler runs passes in ordered phases (optimization, removal, decoration). Autowiring uses TypeScript's AST (via @typescript-eslint/typescript-estree) to scan source files and register services automatically. The library also provides validation, graph export in multiple formats (JSON, Mermaid, DOT), and a condition evaluation system for environment-aware service registration. The codebase is well-structured with clear separation of concerns, extensive tests (both JavaScript and TypeScript), and demonstrates several design patterns (compiler pass, strategy for loaders/dumpers, reference objects, condition evaluation). However, the project appears unmaintained: the last CHANGELOG entry is from 2018, dependencies are outdated (e.g., commander v8, chalk v4, TypeScript 4.6.4), and the package.json version is 0.0.0. Despite its age, the core concepts remain relevant and the code quality is solid for a library of its kind.
This repository is a static data collection of malware indicators of compromise (IOCs) organized by APT threat actor. It contains no application code, scripts, or executable logic; the content is entirely markdown files, each holding a consistent five-column table (Hash, Type, Family, First_Seen, Name) with VirusTotal links. The data spans roughly 2007-2025 and covers file types including PE executables, documents, Android APKs, ELF binaries, and LNK files. The directory structure groups hashes by actor, making the markdown tables the primary entry points for IOC lookup or ingestion.