
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
fragments structures web applications with (request time) dependency injection
fragments has beta status. it's been in production use for over a year. things are quite settled now. i aim for release in fall/winter 2015. expect some breakage until then but not much. i won't support any but the newest version.
the documentation in this readme is work in progress and currently unfinished !
fragments structures web applications with (request time) dependency injection
hello-world.js is a minimal fragments app contained
in a single file with only around 50 lines of code.
when called with ./hello-world.js serve it starts a http server
on the port that is set in the environment variable PORT.
that server responds to http GET requests
to path /hello-world with ContentType text/plain and body Hello world.
it responds with status code 404 Not Found to all other requests.
var factories = {
server: function(
commonMiddlewarePrelude,
sequenz,
actionHelloWorld,
notFound
) {
return sequenz([
commonMiddlewarePrelude,
actionHelloWorld,
notFound
]);
},
notFound: function(
MIDDLEWARE
) {
return MIDDLEWARE(function(
endNotFound
) {
endNotFound();
});
},
endHelloWorld: function(
end200Text
) {
end200Text('Hello world');
},
actionHelloWorld: function(
GET
) {
return GET('/hello-world', function(
endHelloWorld
) {
endHelloWorld();
})
}
};
// thats it for the application code !
// below is just configuration boilerplate.
// it's needed only once per app.
var fragments = require('fragments');
var hinoki = require('hinoki');
var source = hinoki.source([
factories,
fragments.source,
fragments.umgebung
]);
var source = hinoki.decorateSourceToAlsoLookupWithPrefix(source, 'fragments_');
var app = fragments(source);
app.runCommand();
expect a detailed walkthrough soon.
see the example app as well.
entry point is example/app.
there are integration tests for the example app.
fragments builds on top of hinoki: effective yet simple dependency injection and more for Node.js and browsers
FAQs
fragments structures web applications with (request time) dependency injection
We found that fragments demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.