
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
async-limiter
Advanced tools
A module for limiting concurrent asynchronous actions in flight. Forked from queue.
This module exports a class Limiter that implements some of the Array API.
Pass async functions (ones that accept a callback or return a promise) to an instance's additive array methods.
Certain functions, like zlib, have undesirable behavior when
run at infinite concurrency.
In this case, it is actually faster, and takes far less memory, to limit concurrency.
This module should do the absolute minimum work necessary to queue up functions. PRs are welcome that would make this module faster or lighter, but new functionality is not desired.
Style should confirm to nodejs/node style.
var Limiter = require('async-limiter')
var t = new Limiter({concurrency: 2});
var results = []
// add jobs using the familiar Array API
t.push(function (cb) {
results.push('two')
cb()
})
t.push(
function (cb) {
results.push('four')
cb()
},
function (cb) {
results.push('five')
cb()
}
)
t.unshift(function (cb) {
results.push('one')
cb()
})
t.splice(2, 0, function (cb) {
results.push('three')
cb()
})
// Jobs run automatically. If you want a callback when all are done,
// call 'onDone()'.
t.onDone(function () {
console.log('all done:', results)
})
const zlib = require('zlib');
const Limiter = require('async-limiter');
const message = {some: "data"};
const payload = new Buffer(JSON.stringify(message));
// Try with different concurrency values to see how this actually
// slows significantly with higher concurrency!
//
// 5: 1398.607ms
// 10: 1375.668ms
// Infinity: 4423.300ms
//
const t = new Limiter({concurrency: 5});
function deflate(payload, cb) {
t.push(function(done) {
zlib.deflate(payload, function(err, buffer) {
done();
cb(err, buffer);
});
});
}
console.time('deflate');
for(let i = 0; i < 30000; ++i) {
deflate(payload, function (err, buffer) {});
}
q.onDone(function() {
console.timeEnd('deflate');
});
npm install async-limiter
npm test
var t = new Limiter([opts])Constructor. opts may contain inital values for:
q.concurrencyq.onDone(fn)fn will be called once and only once, when the queue is empty.
ArrayMozilla has docs on how these methods work here.
q.push(element1, ..., elementN)q.unshift(element1, ..., elementN)q.splice(index , howMany[, element1[, ...[, elementN]]])q.concurrencyMax number of jobs the queue should process concurrently, defaults to Infinity.
q.lengthJobs pending + jobs to process (readonly).
Bottleneck is a powerful rate limiter that allows you to throttle functions and prioritize job queues. It provides more advanced features like clustering support and job scheduling compared to async-limiter.
p-limit is a package that limits the number of promises running at the same time. It is similar to async-limiter but works specifically with promises, providing a simple API to control concurrency.
Async is a utility module which provides straight-forward, powerful functions for working with asynchronous JavaScript. It offers more than just limiting, including a wide range of functions for control flow, collection processing, and utilities. It's more comprehensive than async-limiter.
FAQs
asynchronous function queue with adjustable concurrency
The npm package async-limiter receives a total of 8,964,693 weekly downloads. As such, async-limiter popularity was classified as popular.
We found that async-limiter demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.