
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
You can find the documentation and downloads on the project website.
If you're looking to get an old version of the library, you can build off the associated tag. We very strongly recommend you use the latest version. If you run into a bug on the latest version, report it on the issue tracker. We'll try to fix the bug as soon as possible, and we'll give you a snapshot build that includes the fix for you to use until the next official bugfix release.
Please refer to CONTRIBUTING.md.
Install npm and gulp. Of course, npm install before using gulp.
Run gulp in the console. The main targets are:
Building:
build : build the libraryzip : build the release ZIPclean : clean the build directorydist : update the distribution JS for npm, bower, etc.File references:
refs : update all refstestrefs : update JS lib file refs in the tests pagetestlist : update list of test JS files in tests pageTesting:
test : run the Mocha unit testslint : lint the JS sources via jshintwatch : update JS refs in HTML files (debug page, test page) automatically when JS files are added or deletedDocumentation:
docs : build the documentation templatedocsmin : build the documentation template with all resources minifieddocspub : build the documentation for publishing (ZIPs, JS refs, etc.)docspush : push the built documentation to productionVERSION environment variable, e.g. export VERSION=1.2.3VERSION is picked up by gulp: gulp versiongulp lintgulp testgulp publishMocha tests are found in the test directory. The tests can be run in the browser or they can be run via Node.js (gulp test).
FAQs
Concise and readable multitasking
We found that weaverjs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.