
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Bubo is a powerful Go library for building and orchestrating AI agents with a focus on reliability, extensibility, and maintainable workflows.
Bubo provides a robust foundation for creating AI-powered applications by offering:
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Agent │ │ Provider │ │ Tool │
│ Orchestration │◄────┤ Integration │◄────┤ System │
└─────────────────┘ └─────────────────┘ └─────────────────┘
▲ ▲ ▲
│ │ │
▼ ▼ ▼
┌─────────────────┐ ┌─────────────────┐ ┌─────────────────┐
│ Event │ │ Memory │ │ Workflow │
│ System │◄────┤ Management │◄────┤ Engine │
└─────────────────┘ └─────────────────┘ └─────────────────┘
go get github.com/casualjim/bubo
This example demonstrates how to create agents that can transfer control between each other based on language:
package main
import (
"context"
"log/slog"
"os"
"time"
// Ensure API Key is loaded
_ "github.com/joho/godotenv/autoload"
"github.com/casualjim/bubo"
"github.com/casualjim/bubo/api"
"github.com/casualjim/bubo/examples/internal/msgfmt"
"github.com/casualjim/bubo/agent"
"github.com/casualjim/bubo/provider/openai"
)
// Define agents with specific language capabilities
var (
englishAgent = agent.New(
agent.Name("English Agent"),
agent.Model(openai.GPT4oMini()),
agent.Instructions("You only speak English, so you only reply in english."),
agent.Tools(transferToSpanishAgentTool),
)
spanishAgent = agent.New(
agent.Name("Spanish Agent"),
agent.Model(openai.GPT4oMini()),
agent.Instructions("You only speak Spanish, so you only reply in spanish."),
)
)
// Transfer spanish speaking users immediately
//
// bubo:agentTool
func transferToSpanishAgent() api.Agent { return spanishAgent }
func main() {
ctx := context.Background()
// Configure console output
hook, result := msgfmt.Console[string](ctx, os.Stdout)
// Create and run workflow
p := bubo.New(
bubo.Agents(englishAgent),
bubo.Steps(
bubo.Step(englishAgent.Name(), "Hola. ¿Como estás?"),
),
)
if err := p.Run(ctx, bubo.Local(hook)); err != nil {
slog.Error("error running agent", "error", err)
return
}
<-result
}
See the examples directory for more usage patterns including:
Agents use providers to interact with AI models. The provider abstraction allows for easy integration of different AI services.
Tools extend agent capabilities by providing specific functionalities.
Tools can be generated using the bubo-tool-gen command for marker
comments like:
// bubo:agentTool
func transferToSpanishAgent() api.Agent { return spanishAgent }
The memory system helps agents maintain context across interactions and share information.
Providers can utilize tools to enhance AI model capabilities and provide additional functionalities.
Clone the repository:
git clone https://github.com/casualjim/bubo.git
cd bubo
Install dependencies:
go mod download
Run tests:
go test ./...
Code Style
golangci-lint run before submitting PRsTesting
Documentation
Pull Requests
mainThis project is licensed under the LICENSE file in the repository.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.