Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
betterthread
Advanced tools
Betterthread allows you to easily write JavaScript that can be executed in parallel across threads and CPUs for high performance on systems with multiple cores or CPUs.
There are plenty of advanced options, but basic functionality is very easy to use:
const bt = require('betterthread');
const myWorker = new bt.ThreadedFunction((message, done)=>{
const foo = message + ' World!';
done(foo); // pass result back to main thread
});
myWorker.on('data',(data)=>{
console.log(`I computed '${data}' in another thread!`)
myWorker.kill();
});
myWorker.send('Hello');
Node.js doesn't provide a way to simply execute in another thread. Built-ins such as cluster
work great for sharing a HTTP server, but don't work well for general-purpse computing.
10.5.0
?No, this library does not require any experimental features and works on the current LTS version and old versions of Node; right now Node version 6.x.x
to 10.x.x
are supported.
Starting a thread will take somewhere around half a second. You can test this by running node ./examples/spinupPerformance.js
.
With the SHA example, the main thread's time is only 150mSec.
stonegray-vm2:betterthread stonegray$ ps -T -g 41943
PID TTY TIME CMD
41943 ttys005 0:00.15 node shaExample.js
41944 ttys005 0:06.26 /usr/local/bin/node ./betterthread/worker.js
41948 ttys006 0:00.01 ps -T -g 41943
Anything that can run in your main thread can run in a ThreadedFunction; there are currently two exceptions:
process.send()
and process.exit()
will not work as expected; they will apply to the worker not the parent. A patch for this is planned.cluster
library, (eg. running a multithreaded HTTP server) it will not work as expected at this time. A polyfill for cluster
is planned.Not right now. See above, process.send()
and cluster
need to be patched first.
uid
and gid
of a process to restrict the thread's permissions.BetterThread is dual-licenced. For open-source noncommercial projects, BetterThread is available for anybody to freely use, modify, distrobute under the GPLv3.
Defualt options:
{
// Enable console logging
verbose: false,
/* You can request that the child processes be spawned with a different user ID or group ID. You will recieve an EPERM if this fails. */
uid: undefined,
gid: undefined,
/* You can set an execution time limit for the thread; after which it will be killed automatically; millisecond units. */
timeLimit: undefined,
/* To restrict what the process can do, you can run it within a V8 Virtual Machine context. By default, a relatively permissive VM is used, but this can be tweaked. */
vm: false
vmOpts: {
/* Expose native APIs in the VM; by default, only require() and console are available. Note that this allows you to require builtins such as `fs` and `https` which may be unwanted. */
expose: ['require','console']
}
}
FAQs
Easily write high-performance multithreaded JavaScript
The npm package betterthread receives a total of 2 weekly downloads. As such, betterthread popularity was classified as not popular.
We found that betterthread demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.