
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Rate limit the invocation of a function by ignore following invocations.
const redis = require('redis')
const dthrottle = require('dthrottle')
function tested () {
console.log(new Date().toISOString(), 'executing ...')
}
let test = dthrottle(tested, {
wait: 1000,
adapter: new dthrottle.Adapters.Redis({
throttle: 2,
redis: redis.createClient(),
prefix: 'dthrottle:example'
})
})
// even `test` invoked every 100ms, `tested` invoked every 1000ms
setInterval(() => {
test()
}, 100)
func, the function to be ratelimitedopts.wait, invoke the func after opts.wait msopts.adapter, adapter to be usedopts.getId, the function to generate identify id to seprate invocations of funcopts.error, callback that will invoked when opts.adapter failedopts.expire, expire seconds for any locked identify idopts.expire, expire seconds for any locked identify idopts.redis, a redis client with Promise APIsopts.prefix, add prefix for keys to be used in dthrottleAn adapter should have at least two methods: setnx and clear, both return a Promise.
adapter.setnx atomicOn any invocation, An adapter should lock the identify id to ignore later invocations.
FAQs
distribution throttle
The npm package dthrottle receives a total of 0 weekly downloads. As such, dthrottle popularity was classified as not popular.
We found that dthrottle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.