
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
npm install wetbox
let WET = require( 'wetbox' )
getVersion()
Returns the current in-use version of the library
getUrl( url, callback )
Fetches an external API url (typically json) and performs callback( status, response ) when loaded.
Status being a nubmer (ie 400), and response being the data.
zeros( n )
Returns an array of zeros of lenth n
sequence( n )
Returns an array of numbers from 0 .. n-1
randInt( n )
Returns a random int from 0 .. n-1
clearEmptyElements( array )
Remove all zero and falsy values from an array
randomizeArray( array )
Returns array with random-ordered elements using the Fisher-Yates-Knuth shuffle.
leftPad( str, len, fillerChar )
Pads a string up to length len, with single-char: fillerChar (defaults to space character)
toRadians( x )
Convert x degrees to radians
toDegrees( x )
Convert x radians to degrees
hasDuplicates( n )
Returns true if array contains duplicates
choose( n, k )
The mathematical choose function. One-indexed
ithIteration( n, k, i )
Alias for ithCombination( n, k, i )
inverseIthIteration( n, combinationArray )
Alias for inverseIthCombination( n, combinationArray )
ithCombination( n, k, i )
Given a set of n items, k choices, and an index i, give me a k-sized array of the ith combination. 0 <= i < n.
inverseIthCombination( n, combinationArray )
Given a number n and combinationArray, convert the array into an ith ordering. k is infered from combinationArrays length.
new WET.game( THREE, gameTitle )
Given a three.js library let THREE = require( 'three' ), initialize a basic game environment using threejs. ie in index.js
WET = require( 'wetbox' )
THREE = require( 'three' )
game = new WET.Game( THREE, 'Wizzy boi' )
keyListen( isEnable, up, left, down, right, crouch, space, esc, tab, enter )
Adds some keyboard listeners to the page for typical game commands. All input params are callback functions, first 5 are mandatory.
WET.keyListen(
enabled => { return true },
up => { console.log( 'up' ) },
left => { console.log( 'left' ) },
down => { console.log( 'down' ) },
right => { console.log( 'right' ) },
crouch => { console.log( 'crouch' ) },
space => { console.log( 'space' ) },
esc => { console.log( 'esc' ) },
tab => { console.log( 'tab' ) },
enter => { console.log( 'enter' ) },
)
keyUpListen( up, left, down, right, crouch )
Adds key-release listeners for switch-keys, all args are callbacks and always enabled.
WET.keyUpListen(
releaseUp => { console.log( 'release up' ) },
releaseLeft => { console.log( 'release left' ) },
releaseDown => { console.log( 'release down' ) },
releaseRight => { console.log( 'release right' ) },
releaseCrouch => { console.log( 'release crouch' ) },
)
Updating
npm publish --dry-run
npm publish
FAQs
A collection of prototype tools
We found that wetbox demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.