
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Delivers a human-readable diagnostic summary, written to file.
The report is intended for development, test and production use, to capture and preserve information for problem determination. It includes JavaScript and native stack traces, heap statistics, platform information and resource usage etc. With the report enabled, reports can be triggered on unhandled exceptions, fatal errors, signals and calls to a JavaScript API.
Supports Node.js v4, v6 and v7 on Linux, MacOS, Windows and AIX.
npm install nodereport
This will allow a NodeReport to be triggered via an API call from a JavaScript application.
var nodereport = require('nodereport');
nodereport.triggerReport();
Content of the NodeReport consists of a header section containing the event type, date, time, PID and Node version, sections containing JavaScript and native stack traces, a section containing V8 heap information, a section containing libuv handle information and an OS platform information section showing CPU and memory usage and system limits. An example NodeReport can be triggered using the Node.js REPL:
$ node
> nodereport = require('nodereport')
> nodereport.triggerReport()
Writing Node.js report to file: NodeReport.20161020.091102.8480.001.txt
Node.js report completed
>
When a NodeReport is triggered, start and end messages are issued to stderr
and the filename of the report is returned to the caller. The default filename
includes the date, time, PID and a sequence number. Alternatively, a filename
can be specified as a parameter on the triggerReport()
call.
nodereport.triggerReport("myReportName");
A NodeReport can also be triggered automatically on unhandled exceptions, fatal error events (for example out of memory errors), and signals (Linux/MacOS only). Triggering on these events can be enabled using the following API call:
nodereport.setEvents("exception+fatalerror+signal+apicall");
Additional configuration is available using the following APIs:
nodereport.setSignal("SIGUSR2|SIGQUIT");
nodereport.setFileName("stdout|stderr|<filename>");
nodereport.setDirectory("<full path>");
nodereport.setCoreDump("yes|no");
nodereport.setVerbose("yes|no");
Configuration on module Initialization is also available via environment variables:
export NODEREPORT_EVENTS=exception+fatalerror+signal+apicall
export NODEREPORT_SIGNAL=SIGUSR2|SIGQUIT
export NODEREPORT_FILENAME=stdout|stderr|<filename>
export NODEREPORT_DIRECTORY=<full path>
export NODEREPORT_COREDUMP=yes|no
export NODEREPORT_VERBOSE=yes|no
To see examples of NodeReports generated from these events you can run the demonstration applications provided in the nodereport github repository. These are Node.js applications which will prompt you to trigger the required event.
api.js
- NodeReport triggered by JavaScript API call.exception.js
- NodeReport triggered by unhandled exception.fatalerror.js
- NodeReport triggered by fatal error on JavaScript heap out of memory.loop.js
- looping application, NodeReport triggered using kill -USR2 <pid>
.FAQs
Diagnostic NodeReport
The npm package nodereport receives a total of 0 weekly downloads. As such, nodereport popularity was classified as not popular.
We found that nodereport demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.