
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
heap-analyzer
Advanced tools
A powerful heap analyzer for Node.js memory profiling and leak detection
A CLI and agent tool for analyzing JavaScript heap snapshots from Google DevTools. Helps developers trace memory issues, browser crashes, and provides actionable insights for fixing leaks in JavaScript apps.
Install as a dev dependency:
npm install --save-dev heap-analyzer
🚀 Quick Start: For immediate heap analysis, see AGENT.md - zero-config automated analysis guide.
🔧 Real-Time Debugging: For browser console debugging snippets, see DEBUGGING_SNIPPETS.md - intercept and track leaks as they happen.
heap-analyzer is a complete memlab wrapper that provides all memlab functionality with better developer experience and easier file management.
# Basic leak detection (2-3 snapshots)
npx heap-analyzer find-leaks --baseline before.heapsnapshot --target after.heapsnapshot
npx heap-analyzer find-leaks --baseline baseline.heapsnapshot --target target.heapsnapshot --final final.heapsnapshot
# Auto-detect snapshots in directory
npx heap-analyzer find-leaks --snapshot-dir ./snapshots/
# Compare memory growth between snapshots
npx heap-analyzer compare before.heapsnapshot after.heapsnapshot
# Single snapshot analysis
npx heap-analyzer analyze snapshot.heapsnapshot
# Interactive heap exploration (memlab wrapper)
npx heap-analyzer heap snapshot.heapsnapshot
# Heap visualization (memlab wrapper)
npx heap-analyzer view-heap snapshot.heapsnapshot
npx heap-analyzer view-heap snapshot.heapsnapshot --node-id 12345
# Analyze why specific objects are retained (memlab wrapper)
npx heap-analyzer trace snapshot.heapsnapshot --node-id 12345
# Take heap snapshot from running Node.js process
npx heap-analyzer node-snapshot --endpoint http://localhost:3000/debug/heap-snapshot
npx heap-analyzer node-snapshot --pid 12345
# Monitor Node.js process memory and auto-snapshot on high usage
npx heap-analyzer node-monitor --pid 12345 --threshold 500 --interval 5
# Load test with automatic heap snapshot collection
npx heap-analyzer node-load-test http://localhost:3000/api/heavy \
--endpoint http://localhost:3000/debug/heap-snapshot \
--concurrency 50 --duration 60
# Run memlab analysis plugins (memlab wrapper)
npx heap-analyzer analyze-plugin string-analysis
npx heap-analyzer analyze-plugin <plugin-name>
# List available snapshots
npx heap-analyzer list
All memlab commands work directly with better path resolution:
# Advanced leak detection with filtering
npx memlab find-leaks --baseline snapshots/sim-1.heapsnapshot --target snapshots/sim-2.heapsnapshot --trace-object-size-above 1000000
# Compare different leak sets
npx memlab diff-leaks --control-snapshot snapshots/before.heapsnapshot --treatment-snapshot snapshots/after.heapsnapshot
# ML-based clustering
npx memlab find-leaks --baseline snapshots/baseline.heapsnapshot --target snapshots/target.heapsnapshot --ml-clustering
Core Commands:
find-leaks - Run memlab leak detection (wrapper for memlab find-leaks)compare <baseline> <target> - Compare memory growth between snapshotsanalyze <file> - Analyze single heap snapshottrace <file> --node-id <id> - Analyze retainer traces (wrapper for memlab trace)heap <file> - Interactive heap exploration (wrapper for memlab heap)view-heap <file> - Heap visualization (wrapper for memlab view-heap)analyze-plugin <plugin> - Run analysis plugins (wrapper for memlab analyze)list - List available snapshotsOptions:
--baseline <file> - Baseline snapshot (initial state)--target <file> - Target snapshot (after action)--final <file> - Final snapshot (after cleanup) - optional--snapshot-dir <dir> - Directory containing snapshots--node-id <id> - Node ID for retainer trace analysis--help, -h - Show help informationFile Path Resolution:
./snapshots/ directoryAll Memlab Commands Available:
Enhanced Developer Experience:
./snapshots/ directoryGrowth Analysis (Our Addition):
The heap analyzer detects memory leaks using only snapshot data, without requiring:
This snapshot-isolated approach ensures accurate leak detection across any JavaScript application, regardless of framework or implementation patterns.
# 1. List available snapshots
npx heap-analyzer list
# 2. Run leak detection
npx heap-analyzer find-leaks --baseline before.heapsnapshot --target after.heapsnapshot
# 3. If leaks found, analyze specific objects
npx heap-analyzer trace after.heapsnapshot --node-id 12345
# 1. Compare memory growth
npx heap-analyzer compare baseline.heapsnapshot target.heapsnapshot
# 2. Interactive exploration of larger snapshot
npx heap-analyzer heap target.heapsnapshot
# 3. Visual inspection
npx heap-analyzer view-heap target.heapsnapshot
# 1. Run memlab's sophisticated leak detection
npx heap-analyzer find-leaks --baseline baseline.heapsnapshot --target target.heapsnapshot --final final.heapsnapshot
# 2. Compare different approaches to same feature
npx memlab diff-leaks --control-snapshot snapshots/approach-a.heapsnapshot --treatment-snapshot snapshots/approach-b.heapsnapshot
# 3. Run analysis plugins for specific insights
npx heap-analyzer analyze-plugin string-analysis
Growth Analysis Output:
📊 Growth Analysis:
Memory growth: 50.01 MB
Growth percentage: 239.7%
🔍 Object Type Analysis:
📈 array: +49.74 MB (+13,022 objects)
📈 object: +0.20 MB (+13,076 objects)
💡 Growth Pattern Analysis:
📊 High memory growth with low object count growth
🎯 This suggests existing objects got larger (data accumulation)
🔍 Check: Arrays growing, string concatenation, cache buildup
Memlab Leak Detection Output:
Alive objects allocated in target page:
┌─────────┬────────────────────────────┬─────────────┬───────┬──────────────┐
│ (index) │ name │ type │ count │ retainedSize │
├─────────┼────────────────────────────┼─────────────┼───────┼──────────────┤
│ 0 │ 'Array' │ 'object' │ 13020 │ '52.3MB' │
│ 1 │ 'MouseEvent' │ 'object' │ 2 │ '2.2KB' │
└─────────┴────────────────────────────┴─────────────┴───────┴──────────────┘
No leaks found - Memory growth is legitimate application behavior
For deep inspection of specific suspicious objects found in your analysis:
npm run inspect-object <snapshot-file> <node-id>
When to use:
Example workflow:
# 1. Run main analysis to find suspects
npm run dev compare
# Output shows: "🔴 userCache (HIGH) - Node ID: 287534"
# 2. Deep dive into the suspicious object
npm run inspect-object snapshots/after.heapsnapshot 287534
# 3. Get detailed analysis with retainer chains, references, and fix recommendations
The Object Content Analyzer provides:
📚 Full documentation: docs/OBJECT_CONTENT_ANALYZER.md
Perfect for automated memory analysis in CI/CD pipelines:
# GitHub Actions example
- name: Memory Leak Detection
run: |
# Generate snapshots in your test suite
npm run test:memory-snapshots
# Run leak detection
npx heap-analyzer find-leaks --baseline snapshots/baseline.heapsnapshot --target snapshots/after-test.heapsnapshot
# Growth analysis for performance monitoring
npx heap-analyzer compare snapshots/baseline.heapsnapshot snapshots/after-test.heapsnapshot
# GitLab CI example
memory_analysis:
script:
- npx heap-analyzer find-leaks --snapshot-dir ./test-snapshots/
- npx heap-analyzer analyze-plugin string-analysis
artifacts:
reports:
# Save memlab output for later analysis
expire_in: 1 week
# Set up automated snapshot comparison
npx heap-analyzer find-leaks --baseline production-baseline.heapsnapshot --target latest-build.heapsnapshot
# Check for memory regressions
npx heap-analyzer compare production-baseline.heapsnapshot feature-branch.heapsnapshot
Data URL/Base64 Accumulation: Canvas operations, image caching, file uploads
toDataURL(), FileReader, growing arrays of base64 stringsEvent Listener Leaks: Missing cleanup in component lifecycle
addEventListener without removeEventListenerTimer Leaks: Uncleaned intervals and timeouts
setInterval, setTimeout without corresponding clear callsCollection Growth: Unbounded arrays, maps, or sets
Memory Growth: Absolute and percentage increase between snapshots Object Count: New objects created, useful for detecting object accumulation File Size Growth: Raw snapshot size difference, indicates data structure bloat
Create heap snapshots in Chrome DevTools:
.heapsnapshot file| Command | Description | Memlab Equivalent |
|---|---|---|
find-leaks | Memory leak detection | memlab find-leaks |
trace <file> --node-id <id> | Retainer trace analysis | memlab trace |
heap <file> | Interactive heap exploration | memlab heap |
view-heap <file> | Heap visualization | memlab view-heap |
analyze-plugin <plugin> | Run analysis plugins | memlab analyze |
compare <baseline> <target> | Growth analysis | (Our enhancement) |
analyze <file> | Single snapshot analysis | (Our enhancement) |
list | List available snapshots | (Our enhancement) |
| Command | Description | Use Case |
|---|---|---|
node-snapshot --endpoint <url> | Take snapshot via HTTP | Production monitoring |
node-snapshot --pid <pid> | Take snapshot via process signal | Development debugging |
node-monitor --pid <pid> | Auto-monitor memory usage | Continuous monitoring |
node-load-test <url> | Load test with snapshots | Performance testing |
# Advanced leak detection with filtering
npx memlab find-leaks --baseline snapshots/baseline.heapsnapshot --target snapshots/target.heapsnapshot --trace-object-size-above 1000000
# Compare leak sets between different implementations
npx memlab diff-leaks --control-snapshot snapshots/old-version.heapsnapshot --treatment-snapshot snapshots/new-version.heapsnapshot
# Machine learning based leak clustering
npx memlab find-leaks --baseline snapshots/baseline.heapsnapshot --target snapshots/target.heapsnapshot --ml-clustering
# Trace specific patterns
npx memlab find-leaks --baseline snapshots/baseline.heapsnapshot --target snapshots/target.heapsnapshot --trace-contains "EventListener"
# Interactive heap exploration with specific node focus
npx memlab view-heap --snapshot snapshots/large-heap.heapsnapshot --node-id 12345
All commands support smart path resolution:
# These are equivalent:
npx heap-analyzer find-leaks --baseline baseline.heapsnapshot --target target.heapsnapshot
npx heap-analyzer find-leaks --baseline ./snapshots/baseline.heapsnapshot --target ./snapshots/target.heapsnapshot
npx heap-analyzer find-leaks --baseline /absolute/path/to/baseline.heapsnapshot --target /absolute/path/to/target.heapsnapshot
# Directory mode automatically finds files:
npx heap-analyzer find-leaks --snapshot-dir ./snapshots/
Debugging Memory Leaks:
heap-analyzer find-leaks --baseline before.heapsnapshot --target after.heapsnapshotheap-analyzer trace after.heapsnapshot --node-id <leaked-object-id>heap-analyzer heap after.heapsnapshot (for interactive exploration)Performance Analysis:
heap-analyzer compare baseline.heapsnapshot optimized.heapsnapshotheap-analyzer analyze-plugin string-analysisnpx memlab diff-leaks --control-snapshot baseline.heapsnapshot --treatment-snapshot optimized.heapsnapshotDevelopment Workflow:
heap-analyzer list (see available snapshots)heap-analyzer find-leaks --snapshot-dir ./snapshots/ (auto-detect and analyze)heap-analyzer view-heap latest.heapsnapshot (visual inspection)MIT
FAQs
A powerful heap analyzer for Node.js memory profiling and leak detection
The npm package heap-analyzer receives a total of 12 weekly downloads. As such, heap-analyzer popularity was classified as not popular.
We found that heap-analyzer demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.