
Security News
The Next Open Source Security Race: Triage at Machine Speed
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.
Down the rabbit hole...
A tool which renders a visualization of the call stack during the entire lifetime of a request. Showing all parent<->child relationships following any nesting. Basically it shows every line of code executed during the request, and by what.
Any parent file it does not recognise (or running in a new tick) will be placed at the top level (i.e. Express/React/react-router/Promises etc) for now.

Alice defaults to just showing the file name to give the user the option to show/hide that files executed code.

1. npm install -g node-alice
2. node-alice <entry-file>.js
3. // open your app in the browser
4. // turn the app off via <ctrl+c>
5. open alice-analyser.html
To help understand and learn (and perhaps debug) exactly what runs and from where with your application. Easily find any deep nesting and how often it is called. You can observe the code which is being run at run-time.
Of course server-side debuggers (e.g. iron-node, node debug) can show you similar information, but Alice requires no code statements or additional clicking and produces an easy to read and follow tree. You can jump straight to the area you are interested in.
As its storing exactly what code is executed, if you use a transpiler (e.g. Babel) it will show the post-compiled code.
If you used babel-node CLI you must define a .babelrc or "babel": {} block in your package.json in order for node-alice to run. Without the correct presets and plugins your app wont work (as a side-note I find it important/useful to know what my application uses from Babel anyway).
This is because node-alice uses a require-hook and babel checks up the tree for .babelrc (not down), so will not have any presets/plugins set for it. Help can be found https://babeljs.io/docs/usage/babelrc/.
Please feel free to create an issue or email me to let me know about any bugs you discover. I would appreciate any help. Thanks
FAQs
Get a visualization of the call stack during the lifetime of a request.
The npm package node-alice receives a total of 5 weekly downloads. As such, node-alice popularity was classified as not popular.
We found that node-alice demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Claude Opus 4.6 has uncovered more than 500 open source vulnerabilities, raising new considerations for disclosure, triage, and patching at scale.

Research
/Security News
Malicious dYdX client packages were published to npm and PyPI after a maintainer compromise, enabling wallet credential theft and remote code execution.

Security News
gem.coop is testing registry-level dependency cooldowns to limit exposure during the brief window when malicious gems are most likely to spread.