
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
A micro HTTP service that runs darknet / yolo on provided images/video's. This allows you to easily offload this heavy computing to a cloud server that has support for GPU.
The package is published to npm and can be installed by running:
npm install --save darknode
{
//
// Port number the HTTP server should listen on.
//
"port": 8080,
//
// Sets a pre-configured log level as for development we want to be more
// verbose.
//
"NODE_ENV": 'development',
//
// Basic Auth configuration. Every server is configured with basic auth by
// default. User and pass must match this value in order to be processed.
//
"name": "secret-username",
"password": "secret-password",
//
// Timeout, how long do we allow the darknet process to run before we consider
// it's computation to long and in need of killing. Can be a human readable
// string or a number.
//
"timeout": "20 minutes",
//
// How many times should we retry in case of failure.
//
"retries": 3,
//
// Amount of process we're allowed to run concurrently so we don't accidentally
// fork bomb our selfs
//
"concurrency": 10,
//
// Duration of how long we should leave the files we download and process
// around. Ideally we want our server / image to stay as clean as possible.
//
"expiree": "30 minutes"
}
The library ships a Node.js Client that can be used to interact with the created server.
const DarkNode = require('darknode/client');
const api = new DarkNode({
username: 'matching username of what is specified in config',
password: 'matching password of what is specified in config',
api: 'http://address-of-server.here/'
})
The client expects 3 options:
username The basic auth username that you configured on teh server.password The password for the basic auth username.api The actual address of your DarkNode HTTP server.There are 2 different ways to receive the data from the DarkNode server, but they both assume the same options as arguments:
payload URL of where the asset is hosted, and requires detection.record Record the DarkNode detection.bgr24 Use bgr24 instead of rgb24 for color encoding.Asks the server to respond with an EventSource / ServerSentEvent response which will receive the detections of your uploaded asset in near real-time.
const stream = client.stream({
payload: 'https://aws.cloud.server/video.mp4'
});
stream.on('data', (detection) => {
console.log('detection')
});
Waits until the all the detections is done to return the response from the server.
client.fetch({
payload: 'https://aws.cloud.server/video.mp4'
}, function (err, payload) {
if (err) throw err;
console.log(payload); // Array with all detections
});
FAQs
HTTP/Docker interface for Darkweb/yolo
The npm package darknode receives a total of 0 weekly downloads. As such, darknode popularity was classified as not popular.
We found that darknode demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.