
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
wpm is a package manager designed to manage WordPress plugins and themes as
packages, similar to how npm works for Node.js or Composer for PHP.
wpm provides a structured way to manage WordPress plugins and themes. It uses
a wpm.json file to define package metadata, including dependencies,
versioning, and other relevant information. The tool interacts with a remote
registry (currently in a development/conceptual stage at registry.wpm.so) to
publish and retrieve packages.
Linux and Mac
curl -fsSL https://wpm.so/install | bash
Windows
powershell -c "irm wpm.so/install.ps1|iex"
Docker
docker pull trywpm/cli
Go
go install go.wpm.so/cli/cmd/wpm@latest
Build from Source
git clone git@github.com:trywpm/cli.git wpm
cd wpm
go build -o wpm ./cmd/wpm
or download the binaries from the release page.
Initialize a new package:
wpm init
This will create a wpm.json file in your project.
Install dependencies:
wpm install
Publish your package:
wpm publish
wpm [OPTIONS] COMMAND
auth: Authenticate with the wpm registry
login: Log in to the registrylogout: Log out from the registryinit: Initialize a new WordPress package
-y or --yes to accept all defaultsinstall: Install dependencies from wpm.json
--no-dev: Skip installing dev dependencies--ignore-scripts: Do not run lifecycle scripts--dry-run: Simulate installation without making changes--save-dev: Save installed packages as dev dependencies--save-prod: Save installed packages as production dependencies (default)--network-concurrency: Set number of concurrent network requests
(default 16)publish: Publish a package to the registry
--dry-run: Validate without publishing--tag: Set the package tag (default: latest)--access: Set access level (public/private)--verbose: Show detailed outputwhoami: Display the current logged-in user
--config: Location of client config files (default: ~/.wpm)-D, --debug: Enable debug mode-l, --log-level: Set logging level (debug, info, warn, error,
fatal)-v, --version: Print version information-h, --help: Show helpRun wpm COMMAND --help for more information about a specific command.
The wpm.json file defines your package and its dependencies:
{
"name": "my-awesome-plugin",
"description": "A short description of my plugin",
"type": "plugin",
"version": "1.0.0",
"license": "GPL-2.0-or-later",
"requires": {
"wp": ">=6.0",
"php": ">=7.4"
},
"dependencies": {
"akismet": "*", // always fetch latest version
"hello-dolly": "1.7.2"
},
"devDependencies": {
"some-dev-plugin": "3.20.2"
},
"config": {
"bin-dir": "wp-bin",
"content-dir": "wp-content",
"runtime": {
"wp": "6.9",
"php": "8.2"
}
}
}
name: Package name (lowercase, alphanumeric, hyphens)type: Either plugin or themeversion: SemVer compatible versiondescription: Brief package descriptionprivate: Set true to prevent accidental publishinglicense: License identifierhomepage: URL to your package's homepagetags: Keywords (maximum 5)dependencies: Production dependenciesdevDependencies: Development-only dependenciesrequires: Minimum requirements which the package supportsconfig: Custom configuration optionsbin-dir: Directory for executable files (default: wp-bin)content-dir: WordPress content directory (default: wp-content)runtime: Runtime environment versions this project is geared to run onruntime.wp: WordPress version (e.g., 6.7, 6.8, 6.9)runtime.php: PHP version (e.g., 7.4, 8.0, 8.1, 8.2)Create a .wpmignore file in your project root to exclude files when
publishing:
node_modules/
.git/
.github/
*.zip
*.log
Documentation will be available soon on the docs.wpm.so site. For now, you can refer to the command line help for detailed usage instructions.
This project is licensed under the MIT License. See the LICENSE file for details.
FAQs
Unknown package
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.