
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
A CLI tool that encodes strings into a table and indices format, with the ability to decode them back to the original message. The encoded data is stored in a JSON format and can be decoded back to the original message, which is then output in base64 format.
# Install globally
npm install -g decaflag
# Or run directly with npx
npx decaflag
# Using global installation
decaflag "Hello, World!"
# Using npx
npx decaflag "Hello, World!"
This will create a data.json file containing the encoded message.
# Using global installation
decaflag-decode
# Using npx
npx decaflag-decode
# Using npm script (alternative)
npm run decode
This will read the data.json file and create a flag file containing the decoded message in base64 format.
The tool works by creating a table of unique characters from the input string and storing their indices. This creates a simple form of encoding that can be easily reversed.
The data.json file contains two main components:
table: A string containing all unique characters from the inputindices: An array of numbers representing positions in the tableExample:
Input:
npx decaflag "hello"
Generated data.json:
{
"table": "helo\0",
"indices": [0, 1, 2, 3, 3, 4]
}
When decoded, this will reconstruct "hello" and output it in base64 format.
More examples:
Input: npx decaflag "Hello, World!"
{
"table": "Helo, Wrd!\0",
"indices": [0, 1, 2, 2, 3, 4, 5, 6, 3, 7, 2, 8, 9]
}
Input: npx decaflag "AABBCC"
{
"table": "ABC\0",
"indices": [0, 0, 1, 1, 2, 2]
}
MIT License - See LICENSE file for details.
FAQs
A CLI tool to encode strings into a table and indices.
We found that decaflag demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.