
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
count-slowly
Advanced tools
const countSlowly = require('count-slowly');
const cs = countSlowly({ stepDuration: 100 });
// Set the initial value
cs.set(1);
// Handle values between your final value
cs.onUpdate((tempValue) => {
// Handle the temp value
});
// Update value when needed
cs.update(100);
// Skip directly to the new value. Calls onUpdate callback with final value then stops.
cs.hurry();
// Stops the onUpdate callbacks without skipping to new value.
cs.stop();
Rely on the .update() method to determine the values.
const cs = countSlowly();
Set the starting value straight-away.
const cs = countSlowly({}, 50);
Set a default duration to stay on each step
const cs = countSlowly({ stepDuration: 100 });
Set the default length of time to arrive at the new count
const cs = countSlowly({ totalDuration: 2000 });
Set an initial integer value. This will call the .onUpdate() callback once if it has been set.
cs.set(1);
Set the callback from each integer between the old value and the new value.
cs.onUpdate((tempValue) => {
console.log(`Called with ${tempValue}`);
});
Set a new value. This will call the .onUpdate() callback for each integer between the old integer and the new integer according to either the factory function's stepDuration or totalDuration value.
cs.update(100);
Set a new value, calling the .onUpdate() callback every 50ms regardless of the factory function's stepDuration or totalDuration value.
cs.update(100, {
overrideStepDuration: 50,
});
Set a new value, calling the .onUpdate() callback as often as needed in order to invoke the callback with 100 after 1200ms regardless of the factory function's stepDuration or totalDuration value.
cs.update(100, {
overrideTotalDuration: 1200,
});
Skip directly to the new value. Calls the .onUpdate() callback with final value then stops.
cs.hurry();
Stop the .onUpdate() callbacks without skipping to the new value.
cs.stop();
FAQs
Make numbers go up or down, one at a time
We found that count-slowly demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.