
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
markata
Advanced tools
Markdown to site, plugins all the way down
A static site generator that will give you a great site with many standard web
features like rss, sitemaps, and seo tags, out of the box. Running markata build will get you a that only requires you to write Markdown. If you have
additional features that you want, don't worry, since markata is built
completely on plugins you can develop and install your own plugins to add the
features you want.
This has been a pet project for me to learn library development, plugin driven design, diskcache, and more. It is the core of what builds my own site waylonwalker.com.
The next release will be jinja filled. Out with all the single file templates, template strings, looping through card generation, we will have a proper jinja env with includes, bases, and all the things. It will be much easier to maintain and render faster.
Make sure that you pin down what version of markata you want to use. If you are starting a new project that's probably the latest version from pypi. Things are likely to change in major releases, I do my best to document them, and not to break patches.
Markata is fully configurable through a markata.toml file, but the defaults
allow to build your site right out of the box with nothing more than Markdown.
markata is hosted on pypi and can be installed using pip.
python -m pip install markata
# or if pipx is your thing
pipx install markata
The markata cli includes a new command that will present you with questions
to fill in the jinja variables in this repo.
markata new blog [directory]
markata build
# start the site and watch for changes
markata serve
Now if you open localhost:8000, you will be presented with an example site that will walk you through some features of markata. You can play with it at your own pace, or drop all the pages and start writing your own content.

Markata is able to build your site purely from Markdown, allowing you to get started creating your own content quickly. Out of the box it will cover your seo tags, rss feeds, sitemap, and og images. Since it is built completely from plugins you can remove, modify, or add to any of its behavior.
The docs are still a work in progress, but the
base_cli walks through how to
effectively use the markata build command. At this point Markata is far from
stable and will change quite a bit, should you choose to use it on real
site make sure you pin to the version that you want to build from. I will let
you know as it becomes more stable and ready to use without diligence of
pinning to the version you want.
Honestly A big motivation for me was wanting to learn and understand how to create a project that is completely plugin driven. This is highly a learning project for me, and it has grown into something I use every day.
Markata has a project gallery to show off sites built with markata. Please submit yours, and check out the project-gallery for inspiration.
FAQs
Static site generator plugins all the way down.
We found that markata demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.