
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
@afilmory/builder
Advanced tools
这是照片库构建系统的核心模块,采用模块化设计,将不同功能分离到各自的模块中。
src/core/
├── types/ # 类型定义
│ └── photo.ts # 照片相关类型
├── logger/ # 日志系统
│ └── index.ts # 统一日志器
├── s3/ # S3 存储操作
│ ├── client.ts # S3 客户端配置
│ └── operations.ts # S3 操作(上传、下载、列表)
├── image/ # 图像处理
│ ├── processor.ts # 图像预处理和元数据
│ ├── blurhash.ts # Blurhash 生成
│ ├── thumbnail.ts # 缩略图生成
│ └── exif.ts # EXIF 数据提取
├── photo/ # 照片处理
│ ├── info-extractor.ts # 照片信息提取
│ └── processor.ts # 照片处理主逻辑
├── manifest/ # Manifest 管理
│ └── manager.ts # Manifest 读写和管理
├── worker/ # 并发处理
│ └── pool.ts # Worker 池管理
├── builder/ # 主构建器
│ └── index.ts # 构建流程编排
└── index.ts # 模块入口
types/)PhotoInfo: 照片基本信息ImageMetadata: 图像元数据PhotoManifestItem: Manifest 项目ProcessPhotoResult: 处理结果ThumbnailResult: 缩略图生成结果logger/)s3/)image/)photo/)manifest/)worker/)builder/)import { buildManifest } from './src/core/index.js'
await buildManifest({
isForceMode: false,
isForceManifest: false,
isForceThumbnails: false,
concurrencyLimit: 10,
})
import { getImageFromS3, generateThumbnailAndBlurhash, extractExifData } from './src/core/index.js'
// 下载图片
const buffer = await getImageFromS3('path/to/image.jpg')
// 生成缩略图
const result = await generateThumbnailAndBlurhash(buffer, 'photo-id', 1920, 1080)
// 提取 EXIF
const exif = await extractExifData(buffer)
image/ 目录下创建新模块index.ts 中导出新功能photo/processor.ts 中集成s3/ 目录下创建新的操作模块import { logger } from './src/core/index.js'
const customLogger = logger.worker(1).withTag('CUSTOM')
customLogger.info('自定义日志')
FAQs
The npm package @afilmory/builder receives a total of 10 weekly downloads. As such, @afilmory/builder popularity was classified as not popular.
We found that @afilmory/builder demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.