Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
github.com/pyroscope-io/otel-profiling-go
NOTE: This is an experimental package -- and will be officially supported in future versions of Pyroscope
The package provides means to integrate tracing with profiling. More specifically, a TracerProvider
implementation,
that annotates profiling data with span IDs: when a new trace span emerges, the tracer adds a profile_id
pprof tag
that points to the span. This makes it possible to filter out a profile of a particular trace span in Pyroscope.
You can find a full Jaeger example (with custom Jaeger UI) in the tracing/jaeger folder in the Pyroscope repository.
We also added functionality where each individual span is compared to a baseline of spans with similar properties and the diff can be shown in the UI:
For another example of what this package allows you to do you can see with Grafana the ability to link between logs, traces and profiles in the following video (source):
Note that the module does not control pprof
profiler itself – it still needs to be started for profiles to be
collected. This can be done either via runtime/pprof
package, or using the Pyroscope client.
By default, only the root span gets annotated (the first span created locally), this is done to circumvent the fact that the profiler records only the time spent on CPU. Otherwise, all the children profiles should be merged to get the full representation of the root span profile.
There are few limitations:
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.