Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
@dapplion/benchmark
Advanced tools
Ensures that new code does not introduce performance regressions with CI. Tracks:
Ensures that new code does not introduce performance regressions with CI. Tracks:
This tooling provides both a easy to use runner for benchmarking and easy integrations to persist past benchmark data.
Create a test mocha test file but use itBench
instead of it
import {itBench, setBenchOpts} from "../../src";
describe("Sum array benchmark", () => {
itBench("sum array with reduce", () => {
arr.reduce((total, curr) => total + curr, 0);
});
});
Then run the CLI, compatible with all mocha options.
benchmark 'test/perf/**/*.perf.ts' --local
Inspect benchmark results in the terminal
Sum array benchmark
✔ sum array with reduce 826.0701 ops/s 1.210551 ms/op x0.993 578 runs 1.21 s
This tool is a CLI wrapper around mocha, example usage:
benchmark 'test/perf/**/*.perf.ts' --s3
The above command will:
Below is a suggested Github action to run this tool with s3 history provider:
name: Benchmark
# Ensure a single benchmark is run at a time
concurrency: cd-benchmark-${{ github.ref }}
on:
push:
branches:
- main
pull_request:
branches:
- main
jobs:
s3:
if: always()
runs-on: ubuntu-latest
# Ensure both don't run at the same time
needs:
- local
# - ga-cache
steps:
- uses: actions/checkout@v2
- uses: actions/setup-node@v2-beta
- run: yarn install --frozen-lockfile
# Run benchmark with custom tooling and stores the output to a file
- name: Run performance tests
run: yarn benchmark --s3
env:
GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
# S3 credentials
S3_ACCESS_KEY: ${{ secrets.S3_ACCESS_KEY }}
S3_SECRET_KEY: ${{ secrets.S3_SECRET_KEY }}
S3_REGION: ${{ secrets.S3_REGION }}
S3_BUCKET: ${{ secrets.S3_BUCKET }}
S3_ENDPOINT: ${{ secrets.S3_ENDPOINT }}
# Key prefix to separate benchmark data from multiple repositories
S3_KEY_PREFIX: ${{ github.repository }}/${{ runner.os }}
When working on optimizing a function you may want to know if your code is actually faster than the previous implementation.
To do that you can keep a benchmark history file locally and run the benchmark first against previous code
git checkout master
benchmark test/perf/func.perf.ts --local
./benchmark_data
Then measure performance with the new code
git checkout fix1
benchmark test/perf/func.perf.ts --local
./benchmark_data
--defaultBranch
Provide the default branch of this repository to prevent fetching from Github
--persistBranches
Choose what branches to persist benchmark data
--benchmarksPerBranch
Limit number of benchmarks persisted per branch
--threshold
Ratio of new average time per run vs previos time per run to consider a failure. Set to 'Infinity' to disable it.
--compareBranch
Compare new benchmark data against the latest available benchmark in this branch
--compareCommit
Compare new benchmark data against the benchmark data associated with a specific commit
--prune
When persisting history, delete benchmark data associated with commits that are no longer in the current git history
--persist
Force persisting benchmark data in history
--noThrow
Exit cleanly even if a preformance regression was found
--historyLocal
, --local
Persist benchmark history locally. May specify just a boolean to use a default path, or provide a path
--historyGaCache
, --ga-cache
Persist benchmark history in Github Actions cache. Requires Github authentication. May specify just a boolean to use a default cache key or provide a custom key
--historyS3
, --s3
Persist benchmark history in an Amazon S3 bucket. Requires Github authentication
bench compare --from <branch-name | commit-hash> --to <branch-name | commit-hash>
FAQs
Ensures that new code does not introduce performance regressions with CI. Tracks:
The npm package @dapplion/benchmark receives a total of 2,883 weekly downloads. As such, @dapplion/benchmark popularity was classified as popular.
We found that @dapplion/benchmark demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.