
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
cacahuate
Advanced tools
.. image:: https://travis-ci.org/tracsa/cacahuate.svg?branch=master :target: https://travis-ci.org/tracsa/cacahuate :alt: Build Status
The process virtual machine
This project defines storage for an abstract process in a company, and implements a virtual machine that keeps track of the execution of instances of the process.
You will need the redis and mongo databases, and rabbitmq for this
to work. I recommend using pipenv or virtualenv in your python projetcs ;)
requirements.txtpytest)you can control your cacahuate installation using this three environment variables:
CACAHUATE_SETTINGS: absolute path to a settings file
FLASK_APP: import path to wsgi module (cacahuate.http.wsgi)
FLASK_DEBUG: set to 1 to turn on flask's debugging
.. code-block:: bash
pip install cacahuate
This is the daemon in charge of moving pointers in the process, run with:
.. code-block:: bash
cacahuated
In this same repository you will find a flask application that exposes a REST api for controling Cacahuate.
How to run
.. code-block:: bash
FLASK_APP=cacahuate.http.wsgi flask run
You can use any wsgi-compliant server, like gunicorn, to run this:
.. code-block:: bash
gunicorn cacahuate.http.wsgi:app
Docs are built using sphinx <http://www.sphinx-doc.org/en/master/>_ and published in
https://tracsa.github.io/cacahuate/index.html. To build a local copy of the docs
navigate to the docs/ directory and run:
.. code-block:: bash
make html
For more options just run make by itself.
./release.sh cacahuate/version.txt [major|minor|patch]
FAQs
The process virtual machine
We found that cacahuate demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.