
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
ratelim
Advanced tools
Ratelim is a simple Python library that limits the number of times a function can be called during a time interval. It is particularly useful when using online APIs, which commonly enforce rate limits.
.. code-block:: bash
$ pip install ratelim
Say you want to call a function at most for n_calls during a n_seconds time interval.
.. code-block:: python
# 10 times in 5 seconds
@ratelim.greedy(10, 5)
def hello():
print("hello")
The greedy rate limiter calls does not delay any function call until it's really necessary.
In some scenarios, for example when crawling data from an API, you want to maximize the number
of calls you make and you want to avoid sending them in short sequence. To this aim, we can
use the patient rate limiter. It distributes calls evenly between each other.
.. code-block:: python
# 10 times in 5 seconds
# Gets called at most every 0.5 seconds
@ratelim.patient(10, 5)
def hello():
print("hello")
MIT.
FAQs
Makes it easy to respect rate limits.
We found that ratelim demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.