Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
benchmarking
Advanced tools
Wrap a promise and send it to loop N times and receive back a time period in seconds. Use the result for benchmarking purposes.
#Motivation
When developing some Node.js module, I wanted to check the speed of different methods. So before writing the code I intended, I decided to publish this script first.
#Example
var Promise = require('bluebird');
var screaper = require('screaper');
var Cream = require('./benchmark-cream');
var options = {selector: "h2", class: "entry-title", endTag: "a", length: "250"};
var giveMeOnePromise = function () {
return new Promise(function (resolve, reject) {
screaper.action('http://www.prometod.eu/en/', options).then(function (data) {
resolve(data)
}).catch(console.log)
})
};
Cream.main(100, giveMeOnePromise, function (result) {
console.log(result)
})
-giveMeOnePromise - a common pattern to wrap your asynchronous function with new promise
-screaper.action - thenable method under benchmarking.
#API
##main(numberLoops, giveMeOnePromise, callback)
-- numberLoops - number iterations -- giveMeOnePromise - thenable -- callback - it returns an object
###.time - time as a number - the period between the start and the finish of benchmarking
###.timeString - time as a string
example output - '38 seconds'
###.data - array of resolved within giveMeOnePromise values
For example, if you resolve a string, you will get array of strings
example output - [resolvedDataStep1,resolvedDataStep2, ... resolvedDataStepN]
##returnTime
same as main but returns only time as number
##each
same as main but uses async's each and returns time as number
##times
same as main but uses async's times and returns an array:
index 0 => time as number
index 1 => array of resolved within giveMeOnePromise values
#Tests
The tests file is not only show the library in actin, but also shows how cool testing is with Unexpected.
FAQs
This package is no longer supported and has been deprecated. To avoid malicious use, npm is hanging on to the package name.
We found that benchmarking demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.