Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
elm-solve-deps-wasm
Advanced tools
This repo holds a dependency solver for the elm ecosystem compiled to a WebAssembly module. The wasm module is published on npm, so you can easily use it in your JS projects with:
let wasm = require("elm-solve-deps-wasm");
wasm.init();
let use_test = false; // solve for normal dependencies, not test dependencies
let additional_constraints = {}; // no additional package needed
let solution = wasm.solve_deps(
elm_json_config, // the elm.json that we have to solve
use_test,
additional_constraints,
fetchElmJson, // user defined (cf example-offline/dependency-provider-offline.js)
listAvailableVersions // user defined (cf example-offline/dependency-provider-offline.js)
);
Shrinking the generated WebAssembly package to the smallest size possible will benefit everyone using it as a dependency, so here is an attempt at doing it. Most of the info required to shrink the wasm size is available in the rustwasm reference book. Here is a summary of the different techniques we use here.
lto
). In theory, this gives LLVM more opportunities to inline and prune functions.opt-level = "z"
to optimize for size instead of for speed.wee_alloc
allocator which is optimized for size instead of the default allocator, optimized for speed.panic = "abort"
and with wasm-snip --snip-rust-panicking-code
.wasm-opt -Oz -o output.wasm input.wasm
on the output of wasm-pack. Remark that it's better to use the latest one from the binaryen project instead of the one shipped with wasm-pack automatically, so we add wasm-opt = false
to wasm-pack config.twiggy
to find optimization opportunities. This requires adding debug = true
to the release compilation profile, and -g
to wasm-opt
.With the above tricks we start with a .wasm
file weighing 470kb and end with a 251kb file!
Most of it comes from the wasm-opt
tool.
Here is the detail of what each step brings:
--release
size: 479kb.wee_alloc
: 470kb.wasm-opt -Oz
: 366kb.lto = true
and opt-level = "z"
: 276kb.wasm-snip --snip-rust-panicking-code
: 271kb.debug = true
and using twiggy, I found out that there was a non-negligeable part of the wasm binary dedicated to formatting f64 numbers. But in fact, this never happens in our use case, so we can snipe it!wasm-snip -p "core::fmt::float::<impl core::fmt::Display for f64>::fmt::.*"
: 251kb.So in summary, the steps to get the most shrinked wasm module are the following:
wasm-pack build --target nodejs
wasm-snip --snip-rust-panicking-code -p "core::fmt::float::<impl core::fmt::Display for f64>::fmt::.*" -o snipped.wasm pkg/elm_solve_deps_wasm_bg.wasm
wasm-opt -Oz -o output.wasm snipped.wasm
cp output.wasm pkg/elm_solve_deps_wasm_bg.wasm
All that being said, if you don't want to bother installing wasm-snip
and the latest wasm-opt
, you can simply call:
wasm-pack build --profiling --target nodejs
and let the provided wasm-opt do its job, with a generated .wasm
of size 276kb.
FAQs
A dependency solver for the elm ecosystem
The npm package elm-solve-deps-wasm receives a total of 12,469 weekly downloads. As such, elm-solve-deps-wasm popularity was classified as popular.
We found that elm-solve-deps-wasm demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.