
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
examination
Advanced tools
Thoroughly examine the state of a Node.js process. examination allows a heap snapshot, diagnostics report, and core dump to be generated and written to an output directory with a single function call.
'use strict';
const Examination = require('examination');
// Dump the report, core, and heap snapshot to the __dirname directory.
Examination({
directory: __dirname,
heapdump: true,
report: true,
core: true
}, (err) => {
if (err) {
// Handle error
}
});
// Alternatively...
// Create a reusable bound function that only writes a heap snapshot and
// diagnostics report to /tmp/foo.
const bound = Examination.bind(null, {
directory: '/tmp/foo',
heapdump: true,
report: true
}, (err) => { /* Ignore error */ });
bound();
options (object) - A configuration object supporting the following schema.
directory (string) - The directory where the output files will be written. If this directory (including any parent directories) does not exist, it will be created.heapdump (boolean) - If true, a heap snapshot will be written to directory. Defaults to false.report (boolean) - If true, a diagnostics report will be written to directory. Defaults to false.core (boolean) - If true, an archive containing a core file and all loaded native libraries will be written to directory. Defaults to false. Note that generating these files in particular will take time and consume considerable disk space.error (error) -callback (function) - A function that is called after all artifacts have been created. This function takes the following arguments.
err (error) - Represents any error that occurs. Note that the artifacts are created in parallel, so it is possible to receive an error here and still have one or more output files written.FAQs
Thoroughly examine the state of a Node.js process
We found that examination demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.