
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
omdev
Advanced tools
Development utilities and support code.
cli - The codebase's all-in-one CLI. This is not
installed as an entrypoint / command when this package is itself installed - that is separated into the omdev-cli
installable package so as to not pollute users' bin/ directories when depping this lib for its utility code.
amalg - The amalgamator.
pyproject
(amalg) - python project management tool.
wrangles but does not replace tools like venv, pip, setuptools, and uv. does things like sets up venvs, generates
.pkg directories and their pyproject.toml's (from their
__about__.py's), and packages them. this should grow to eat more and more of the Makefile. as it is amalgamated it
requires no installation and can just be dropped into other projects / repos.
ci
(amalg) - ci runner. given a
compose.yml
and requirements.txt files, takes care of building and caching of containers and venvs and execution of required ci
commands. detects and natively uses
github-action's caching system. unifies ci execution between local dev and github runners.
tools.json (cli: om j) - a tool for json-like
data, obviously in the vein of jq but using the internal
jmespath engine. supports
true streaming json input and output, as
well as various other non-streaming input
formats.
tools.git (cli: om git) - a tool for various lazy
git operations, including the one that (poorly) writes all of these commit messages.
Amalgamation is the process of stitching together multiple python source files into a single self-contained python script. 'lite' code is written in a style conducive to this.
Some of this code, when asked, will store things on the local filesystem. The only directories used (outside of ones explicitly specified as command or function arguments) are managed in home.paths, and are the following:
$OMLISH_HOME, default of ~/.omlish - persistent things like config and state.$OMLISH_CACHE, default of ~/.cache/omlish - used for things like the local ci cache and
various other cached data.FAQs
omdev
We found that omdev demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.