
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
electron-optimize
Advanced tools
Drop-in optimization utilities for Electron apps — temp file cleanup, window bounds validation, startup timing, cache management, and power state handling.
Drop-in optimization utilities for Electron apps. Each function is independent — import what you need, skip what you don't.
Built by Yaw Labs, extracted from a shipping Electron app after a user ran a full performance audit and we systematically verified every finding.
npm install electron-optimize
Chromium creates .tmp files in Network/ and Session Storage/ directories that are never cleaned up. Over weeks of use, these accumulate silently. This function removes them on startup.
import { cleanupTempFiles } from 'electron-optimize';
import { app } from 'electron';
app.whenReady().then(() => {
const removed = cleanupTempFiles(app.getPath('userData'));
if (removed > 0) console.log(`Cleaned ${removed} temp files`);
});
Options:
subdirs — directories to scan (default: ['Network', 'Session Storage'])extensions — file extensions to remove, case-insensitive (default: ['.tmp'])After an app update, stale compiled resources in the HTTP cache can cause the renderer to load old code. This detects version changes and clears the relevant caches.
Not called automatically — you must explicitly call this function. Offline-first apps should either skip this or set clearCacheStorage: false.
import { clearCacheOnUpdate } from 'electron-optimize';
import { app, session } from 'electron';
app.whenReady().then(async () => {
const result = await clearCacheOnUpdate(
app.getPath('userData'),
app.getVersion(),
session.defaultSession,
);
if (result.versionChanged) {
console.log(`Updated ${result.previousVersion} -> ${result.currentVersion}`);
}
});
Options:
clearCacheStorage — clear Service Worker caches (default: true). Set to false for offline-first apps.clearHttpCache — clear HTTP disk cache (default: true)versionFilename — file used to track last-run version (default: '.last-version')When users save and restore window positions, saved coordinates become invalid if a monitor is disconnected, resolution changes, or DPI settings change. This ensures windows always appear on a visible display.
import { validateWindowBounds } from 'electron-optimize';
import { screen, BrowserWindow } from 'electron';
// Restoring a saved window
const saved = loadSavedBounds(); // { x, y, width, height } or null
const targetPoint = saved ?? screen.getCursorScreenPoint();
const display = screen.getDisplayNearestPoint(targetPoint);
const bounds = validateWindowBounds(saved, display.workArea);
const win = new BrowserWindow({ ...bounds });
How it works:
Options:
defaultWidthFraction / defaultHeightFraction — size for new/off-screen windows (default: 0.8)minWidth / minHeight — minimum window dimensions (default: 400 / 300)Measures initialization milestones with process.hrtime.bigint() for sub-millisecond precision. Zero overhead when marks aren't read.
import { createStartupTimer } from 'electron-optimize';
const timer = createStartupTimer();
import { app } from 'electron';
timer.mark('imports done');
app.whenReady().then(() => {
timer.mark('app ready');
createWindow();
timer.mark('window created');
});
// In ready-to-show handler
win.once('ready-to-show', () => {
timer.mark('ready-to-show');
timer.flush();
win.show();
});
Output:
[startup]
45.2ms imports done
312.7ms app ready
318.4ms window created
487.1ms ready-to-show
Methods:
mark(label) — record a milestoneflush() — print all marks and resetgetMarks() — read marks as structured datareset() — clear without printingWhen a laptop sleeps and wakes, polling timers that fired during sleep all execute at once, and network requests fail because WiFi hasn't reconnected. This provides a clean pause/resume lifecycle.
import { managePowerState } from 'electron-optimize';
import { powerMonitor, app } from 'electron';
let pollingTimer: ReturnType<typeof setInterval> | null = null;
const cleanup = managePowerState(powerMonitor, {
onSuspend() {
if (pollingTimer) {
clearInterval(pollingTimer);
pollingTimer = null;
}
},
onResume() {
pollingTimer = setInterval(checkForUpdates, 60_000);
},
});
app.on('before-quit', cleanup);
Options:
resumeDelayMs — delay before calling onResume after wake (default: 5000). Gives the OS time to reconnect WiFi, re-establish VPN, etc.Handles edge cases:
Lists all Chromium/Electron child processes with CPU and memory usage. Useful for development profiling.
import { auditProcesses } from 'electron-optimize';
import { app } from 'electron';
// Wait for processes to stabilize, then audit
setTimeout(() => {
const audit = auditProcesses(app);
console.log(`Total: ${audit.totalMemoryFormatted} across ${audit.processes.length} processes`);
for (const p of audit.processes) {
console.log(` ${p.type} (pid ${p.pid}): ${p.memoryFormatted}`);
}
}, 5000);
Returns:
processes — per-process type, PID, CPU%, memorytotalMemory / totalMemoryFormatted — aggregate memoryrendererCount — number of renderer processesgpuMemory — memory used by GPU processoptimize() function.These are deliberate scope boundaries, not missing features.
MIT
FAQs
Drop-in optimization utilities for Electron apps — temp file cleanup, window bounds validation, startup timing, cache management, and power state handling.
The npm package electron-optimize receives a total of 1 weekly downloads. As such, electron-optimize popularity was classified as not popular.
We found that electron-optimize demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.