
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
CLI tool to use cache for cli-commands to prevent long running commands from executing unnecessarily
cache-sh is a command line tool for caching shell commands. It can be used to cache the results of any shell command, reducing the time it takes to run repetitive tasks.
npm install -g cache-sh
Here are some examples of how you can use cache-sh with prisma generate and
tsc.
cache-sh -i "{./prisma/schema.prisma,node_modules/**/.prisma/client/**/*.*}" \
pnpm prisma generate
In this example cache-sh will check if the prisma/schema.prisma file AND the
generated .prisma/client has changed and exists, since the last time
prisma generate was run.
If it hasn't, cache-sh will skip running the command and use the cached result
instead.
cache-sh -i "{src/**/*,dist/**/*}" tsc
In this example, cache-sh will check if any .ts files in the src directory
have changed since the last time tsc was run. If they haven't, cache-sh will
skip running the command and assume you can use what's already there, instead.
cache-sh [options] -- <command...>
cache-sh [options] <command...>
-V, --version output the version number-i, --input <input> glob that's used as input to check whether the existing
files need to be updated-C, --config <path> set the config path (default: (pwd)/.cache-sh)-d, --cwd <path> set the current working directory-f, --force ignore the cache the command-c, --clear clear the cache-h, --help display help for commandExamples:
$ cache-sh -i "{src/**,dist/**}" -- tsc
$ cache-sh -i hi.log -- "sleep 2 && echo "hi" > hi.log"
$ cache-sh -i "{./prisma/schema.prisma,node_modules/**/.prisma/client/**/*.*}"\
-- pnpm prisma generate
FAQs
CLI tool to use cache for cli-commands to prevent long running commands from executing unnecessarily
We found that cache-sh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.