
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
vetiver
Advanced tools

Vetiver, the oil of tranquility, is used as a stabilizing ingredient in perfumery to preserve more volatile fragrances.
The goal of vetiver is to provide fluent tooling to version, share, deploy, and monitor a trained model. Functions handle both recording and checking the model's input data prototype, and predicting from a remote API endpoint. The vetiver package is extensible, with generics that can support many kinds of models, and available for both Python and R. To learn more about vetiver, see:
You can use vetiver with:
You can install the released version of vetiver from PyPI:
python -m pip install vetiver
And the development version from GitHub with:
python -m pip install git+https://github.com/rstudio/vetiver-python
A VetiverModel() object collects the information needed to store, version, and deploy a trained model.
from vetiver import mock, VetiverModel
X, y = mock.get_mock_data()
model = mock.get_mock_model().fit(X, y)
v = VetiverModel(model, model_name='mock_model', prototype_data=X)
You can version and share your VetiverModel() by choosing a pins "board" for it, including a local folder, Connect, Amazon S3, and more.
from pins import board_temp
from vetiver import vetiver_pin_write
model_board = board_temp(versioned = True, allow_pickle_read = True)
vetiver_pin_write(model_board, v)
You can deploy your pinned VetiverModel() using VetiverAPI(), an extension of FastAPI.
from vetiver import VetiverAPI
app = VetiverAPI(v, check_prototype = True)
To start a server using this object, use app.run(port = 8080) or your port of choice.
This project is released with a Contributor Code of Conduct. By contributing to this project, you agree to abide by its terms.
For questions and discussions about deploying models, statistical modeling, and machine learning, please post on Posit Community.
If you think you have encountered a bug, please submit an issue.
FAQs
Version, share, deploy, and monitor models.
We found that vetiver demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.