
Research
SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.
queenbee
Advanced tools
Queenbee is a workflow language and a package manager for creating DAG workflows which empowers all workflow libraries in Ladybug Tools!
Queenbee is a workflow language for describing workflows! The workflow Schema is inspired by Argo Workflow and borrows a number of terms and expressions from Apache Airflow and Ansible.
Queenbee populates and validates the workflows but does not run them! For running the
workflows see
ladybug-tools/queenbee-luigi
which converts Queenbee workflows to executable
Luigi pipelines.
You can find examples of run-able queenbee workflows in the lbt-recipes repository.
> pip install queenbee
or if you want to use the CLI
> pip install queenbee[cli]
You can access the full docs for this package and its CLI here.
You can also access the Schema Documentation and OpenAPI documentation for:
| Object | Redoc | OpenAPI JSON |
|---|---|---|
| Plugin | redoc | json |
| Recipe | redoc | json |
| Job | redoc | json |
Clone this repo locally
git clone git@github.com:ladybug-tools/queenbee
or
git clone https://github.com/ladybug-tools/queenbee
Install dependencies using poetry:
cd queenbee
poetry shell
poetry install --extras cli
Run Tests:
python -m pytest tests/
Generate Documentation:
sphinx-apidoc -f -e -d 4 -o ./docs/modules ./queenbee
sphinx-build -b html ./docs ./docs/_build
Preview Documentation:
python -m http.server --directory ./docs/_build/
Now you can see the documentation preview at http://localhost:8000
FAQs
Queenbee is a workflow language and a package manager for creating DAG workflows which empowers all workflow libraries in Ladybug Tools!
We found that queenbee demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
An emerging npm supply chain attack that infects repos, steals CI secrets, and targets developer AI toolchains for further compromise.

Company News
Socket is proud to join the OpenJS Foundation as a Silver Member, deepening our commitment to the long-term health and security of the JavaScript ecosystem.

Security News
npm now links to Socket's security analysis on every package page. Here's what you'll find when you click through.