
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
kiara
Advanced tools
A data-centric workflow orchestration framework.
Kiara is the data orchestration engine developed by the DHARPA project. It uses a modular approach to let users re-use tried and tested data orchestration pipelines, as well as create new ones from existing building blocks. It also helps you manage your research data, and augment it with automatically-, semi-automatically-, and manually- created metadata. Most of this is not yet implemented.
git clone https://github.com/DHARPA-Project/kiara.git
cd kiara
python3 -m venv .venv
source .venv/bin/activate
make init
If you use direnv, you can alternatively do:
git clone https://github.com/DHARPA-Project/kiara.git
cd kiara
cp .envrc.disabled .envrc
direnv allow
make init
Note: you might want to adjust the Python version in .envrc (should not be necessary in most cases though)
make targetsinit: init development project (install project & dev dependencies into virtualenv, as well as pre-commit git hook)update-modules: update default kiara modules package from gitflake: run flake8 testsmypy: run mypy teststest: run unit testsdocs: create static documentation pages (under build/site)serve-docs: serve documentation pages (incl. auto-reload) for getting direct feedback when working on documentationclean: clean build directoriesFor details (and other, minor targets), check the Makefile.
> make test
# or
> make coverage
This project is MPL v2.0 licensed, for the license text please check the LICENSE file in this repository.
FAQs
Data-centric workflow orchestration.
We found that kiara demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.