
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
cramjam
Advanced tools
pip install --upgrade cramjam # Requires no Python or system dependencies!
npm install cramjam
A CLI interface is available as cramjam-cli
A Rust crate and C friendly library available at libcramjam
Extremely thin and easy-to-install Python bindings to de/compression algorithms in Rust. Allows for using algorithms such as Snappy, without any system or other python dependencies.
Some basic benchmarks are available in the benchmarks directory
Available algorithms:
cramjam.snappycramjam.brotlicramjam.bzip2cramjam.lz4cramjam.gzipcramjam.zlibcramjam.deflatecramjam.zstdcramjam.xzExperimental (Requires build from source enabling each feature):
cramjam.experimental.blosc2cramjam.experimental.igzipcramjam.experimental.ideflatecramjam.experimental.izlibAll available for use as:
>>> import cramjam
>>> import numpy as np
>>> compressed = cramjam.snappy.compress(b"bytes here")
>>> decompressed = cramjam.snappy.decompress(compressed)
>>> decompressed
cramjam.Buffer(len=10) # an object which implements the buffer protocol
>>> bytes(decompressed)
b"bytes here"
>>> np.frombuffer(decompressed, dtype=np.uint8)
array([ 98, 121, 116, 101, 115, 32, 104, 101, 114, 101], dtype=uint8)
Where the API is cramjam.<compression-variant>.compress/decompress and accepts
bytes/bytearray/numpy.array/cramjam.File/cramjam.Buffer / memoryview objects.
de/compress_into
Additionally, all variants support decompress_into and compress_into.
Ex.
>>> import numpy as np
>>> from cramjam import snappy, Buffer
>>>
>>> data = np.frombuffer(b'some bytes here', dtype=np.uint8)
>>> data
array([115, 111, 109, 101, 32, 98, 121, 116, 101, 115, 32, 104, 101,
114, 101], dtype=uint8)
>>>
>>> compressed = Buffer()
>>> snappy.compress_into(data, compressed)
33 # 33 bytes written to compressed buffer
>>>
>>> compressed.tell() # Where is the buffer position?
33 # goodie!
>>>
>>> compressed.seek(0) # Go back to the start of the buffer so we can prepare to decompress
>>> decompressed = b'0' * len(data) # let's write to `bytes` as output
>>> decompressed
b'000000000000000'
>>>
>>> snappy.decompress_into(compressed, decompressed)
15 # 15 bytes written to decompressed
>>> decompressed
b'some bytes here'
import {Compress, Decompress} from 'cramjam';
const decoder = new TextDecoder();
const encoder = new TextEncoder();
const str = 'hello, world';
const encoded = encoder.encode(str);
const compressed = Compress.brotli(encoded);
const decompressed = Decompress.brotli(compressed);
const decoded = decoder.decode(decompressed);
FAQs
Thin Python bindings to de/compression algorithms in Rust
We found that cramjam demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.