
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@datadog/pprof
Advanced tools
pprof support for Node.js.
Your application will need to be using Node.js 14 or greater.
The pprof module has a native component that is used to collect profiles
with v8's CPU and Heap profilers. You may need to install additional
dependencies to build this module.
pprof has prebuilt binaries available for Linux arm64/x64,
Alpine Linux x64, macOS arm64/x64, windows x64 for Node 14/16/18/20.
No additional dependencies are required.pprof does not have
prebuilt binaries for, the module
node-gyp will be used to
build binaries. See node-gyp's
documentation
for information on dependencies required to build binaries with node-gyp.The pprof CLI can be used to view profiles collected with
this module. Instructions for installing the pprof CLI can be found
here.
Install pprof with npm or add to your package.json.
# Install through npm while saving to the local 'package.json'
npm install --save @datadog/pprof
Update code to collect and save a profile:
const profile = await pprof.time.profile({
durationMillis: 10000, // time in milliseconds for which to
// collect profile.
});
const buf = await pprof.encode(profile);
fs.writeFile('wall.pb.gz', buf, (err) => {
if (err) throw err;
});
View the profile with command line pprof:
pprof -http=: wall.pb.gz
Start program from the command line:
node --require @datadog/pprof app.js
A wall time profile for the job will be saved in
pprof-profile-${process.pid}.pb.gz. View the profile with command line
pprof:
pprof -http=: pprof-profile-${process.pid}.pb.gz
Enable heap profiling at the start of the application:
// The average number of bytes between samples.
const intervalBytes = 512 * 1024;
// The maximum stack depth for samples collected.
const stackDepth = 64;
heap.start(intervalBytes, stackDepth);
Collect heap profiles:
Collecting and saving a profile in profile.proto format:
const profile = await pprof.heap.profile();
const buf = await pprof.encode(profile);
fs.writeFile('heap.pb.gz', buf, (err) => {
if (err) throw err;
})
View the profile with command line pprof.
pprof -http=: heap.pb.gz
Collecting a heap profile with V8 allocation profile format:
const profile = await pprof.heap.v8Profile();
v8-profiler-next is a Node.js package for profiling the V8 JavaScript engine. It provides similar functionalities for CPU and heap profiling. Compared to @datadog/pprof, it focuses more on the V8 engine specifically and might offer more detailed insights for applications heavily relying on V8's features.
node-memwatch is another Node.js package designed for memory leak detection and heap diffing. While it provides valuable insights into memory usage and leaks, it does not offer CPU profiling, making it less comprehensive than @datadog/pprof for overall performance analysis.
FAQs
pprof support for Node.js
The npm package @datadog/pprof receives a total of 3,455,820 weekly downloads. As such, @datadog/pprof popularity was classified as popular.
We found that @datadog/pprof demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.