
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
types-usd
Advanced tools
These stubs are designed to be used with a type checker like mypy to provide static type checking of python code, as well as to provide analysis and completion in IDEs like PyCharm and VSCode (with Pylance).
pip install types-usd
The version of the package corresponds to the version of USD that it is generated from, plus a version suffix for the revision of the stubs
The stubs have been tested against a large USD codebase using mypy, however, there
are still known issues that need to be resolved.
Using these stubs with mypy will produce erros within the stubs themselves, mostly about
missing/unknown types. I've left these errors unsilenced as a reminder to fix them.
I recommend adding the following config to your mypy.ini to silence these errors:
[mypy-pxr.*]
ignore_errors = true
If you find any other issues, please report them on the github issues page.
The stubs are created using information extracted from python signatures generated by boost-python in each function's docstring, combined with data parsed as from the USD C++ docs.
Currently, creating the stubs requires custom forks of mypy and USD, but I hope to have my changes merged into upstream soon.
FAQs
Unofficial python stubs for Pixar's Universal Scene Description (USD)
We found that types-usd demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.