
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
concorde
Advanced tools
Simple static site generator built from Markdown and Jinja
Three commands to produce three things::
concorde pages renders Markdown files through a template, producing new pages
concorde index takes a list of Markdown files that you presumably just rendered
with pages, orders them by date, and renders them through a
template to produce an index file
concorde rss similar to concorde index, but produces an RSS feed instead
Run concorde <command> help for more details.
One distinguishing feature of Concorde is that the templates and the rendered pages do not necessarily have to be HTML. In fact, Concorde was created because of the need to quickly tack on a static blog generator to a site written in PHP.
Concorde is designed to be easily paired with a Makefile to generate a site. For example, given a site laid out like so::
my-example-site
site
a-post.md
another-post.md
templates
index.html
blog-post.html
A Makefile to build the HTML pages, index page, and RSS feed would look like
.. code:: makefile
posts := $(patsubst %.md,%.html,$(wildcard site/*.md))
.PHONY : all clean
all: site/index.html site/rss.xml $(posts)
clean:
-rm site/index.html
-rm site/rss.xml
-rm $(posts)
site/index.html: $(posts) templates/index.html
concorde index --template=templates/index.html --output=$@ --output-extension=.html site/
site/blog/rss.xml : $(posts)
concorde rss --output=$@ --title="My Example Blog" --url="http://example.com/rss.xml" site/
$(posts): site/*.md templates/blog-post.html
concorde pages --template=templates/blog-post.html site/
FAQs
Static site generator using Markdown and Jinja
We found that concorde demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.