
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
@statoscope/cli
Advanced tools
This package supplies Statoscope as CLI tool
npm i @statoscope/cli -g
statoscope [command] [...args]
Validate or compare webpack stats.
validate [...args]
--input
(-i
) - path to a stats.json--reference
(-r
) - path to a stats-file to compare with (optional)--config
(-c
) - path to statoscope config (by default {pwd}/statoscope.config.js
has used)--warn-as-error
(-w
) - treat warnings as errorsExample:
npm install --save-dev @statoscope/stats-validator-plugin-webpack @statoscope/stats-validator-reporter-console @statoscope/stats-validator-reporter-stats-report
statoscope.config.js
module.exports = {
validate: {
// add webpack plugin with rules
plugins: ['@statoscope/webpack'],
reporters: [
// console-reporter to output results into console (enabled by default)
'@statoscope/console',
// reporter that generates UI-report with validation-results
['@statoscope/stats-report', {open: true}],
],
// rules to validate your stats (use all of them or only specific rules)
rules: {
// ensures that the build time has not exceeded the limit (10 sec)
'@statoscope/webpack/build-time-limits': ['error', 10000],
// ensures that bundle doesn't use specified packages
'@statoscope/webpack/restricted-packages': ['error', ['lodash', 'browserify-crypto']],
// ensures that bundle hasn't package duplicates
'@statoscope/webpack/no-packages-dups': ['error'],
// ensure that the download time of entrypoints is not over the limit (3 sec)
'@statoscope/webpack/entry-download-time-limits': ['error', { global: { maxDownloadTime: 3000 } }],
// ensure that the download size of entrypoints is not over the limit (3 mb)
'@statoscope/webpack/entry-download-size-limits': ['error', { global: { maxSize: 3 * 1024 * 1024 } }],
// diff download size of entrypoints between input and reference stats. Fails if size diff is over the limit (3 kb)
'@statoscope/webpack/diff-entry-download-size-limits': [
'error',
{ global: { maxSizeDiff: 3*1024 } },
],
// compares usage of specified packages usage between input and reference stats. Fails if rxjs usage has increased
'@statoscope/webpack/diff-deprecated-packages': ['error', ['rxjs'']],
}
}
}
statoscope validate --input path/to/stats.json
Learn more on @staoscope/stats-validator and @statoscope/stats-validator-plugin-webpack and
Start HTTP-server and serve JSON-stats as HTML report
serve input [...args]
--input
(-i
) - path to one or more webpack stats--host
(-h
) - server host--port
(-p
) - server port--open
(-o
) - open browser after server startExample:
statoscope serve path/to/stats.json -o
Start server and open browser.
Generate HTML report from JSON-stats.
generate input output [...args]
--input
(-i
) - path to one or more webpack stats--output
(-t
) - path to generated HTML--open
(-o
) - open browser after generateExample:
statoscope generate path/to/stats.json path/to/report.html -o
Create statoscope report, save it to path/to/report.html
and open
If you are an engineer or a company that is interested in Statoscope improvements, you may support Statoscope by financial contribution at OpenCollective.
5.11.0 (01 October 2021)
[webpack-ui]
- add new options to specify a regexp
All assets matched the regexp will be ignored from download size/time calculation
[stats-validator-plugin-webpack]
- add asset-type exclude to diff-entry-download-size-limits
-rule
[stats-validator-plugin-webpack]
- add asset-type exclude to diff-entry-download-time-limits
-rule
[stats-validator-plugin-webpack]
- add asset-type exclude to entry-download-size-limits
-rule
[stats-validator-plugin-webpack]
- add asset-type exclude to entry-download-time-limits
-rule
[webpack-ui]
- improve settings popupFAQs
Statoscope CLI tools
The npm package @statoscope/cli receives a total of 18,335 weekly downloads. As such, @statoscope/cli popularity was classified as popular.
We found that @statoscope/cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.