
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
tree_filter
Advanced tools
Filter arbitrary data trees with a concise query language. Similar to how the Jenkins API works, if you happen to be familiar with that.
name,environments # Select specific attributes from a hash
environments[id,last_deploy] # Select attributes from sub-hash
environments[*] # Select all attributes
require 'tree_filter'
data = {
'name' => 'don',
'contact' => {
'phone' => '415-123-4567',
'email' => 'don@example.com'
}
}
TreeFilter.new("name,contact[email]").filter(data)
# => {'name' => 'don', 'contact' => {'email' => 'don@example.com'}}
Different data structures can be presented dependent on whether they are explicitly expanded or not. This is typically used when referring to other resources in an API response.
data = {
'name' => 'don',
'contact' => TreeFilter::Leaf.new('/contact-data/1', {
'phone' => '415-123-4567',
'email' => 'don@example.com'
})
}
TreeFilter.new("*").filter(data)
# => {'name' => 'don', 'contact' => '/contact-data/1'}
TreeFilter.new("contact[*]").filter(data)
# => {'contact' => {'phone' => '415-123-4567', 'email' => 'don@example.com'}}
For nested data structures, evaluation can be defered until it is actually required. This can defer resource lookups, and also allows cyclic structures!
data = { 'name' => 'don', }
data['contact'] = TreeFilter::Leaf.new(
'/contact-data/1',
TreeFilter::Defer.new(->{{
'email' => 'don@example.com',
'person' => TreeFilter::Leaf.new('/person/1', data)
}})
)
TreeFilter.new("contact[person[contact[email]]]").filter(data)
# => {'contact' => {'person' => {'contact' => {'email' => 'don@example.com'}}}}
All rubies that ruby core supports! Should work on JRuby and Rubinius too.
Make a new github issue.
Fork and patch! Before any changes are merged to master, we need you to sign an Individual Contributor Agreement (Google Form).
Run tests:
gem install bundler
bundle
bundle exec rspec
FAQs
Unknown package
We found that tree_filter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.