
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Measure React app performance using dockerized Chromium through [`xrom`](https://github.com/nextools/metarepo/tree/master/packages/xrom) lib.
Measure React app performance using dockerized Chromium through xrom lib.
$ yarn add perfa
type TGetPerfDataOptions = {
entryPointPath: string, // path to a React app entry point
triesCount?: number, // `5` by default
fontsDir?: string, // path to a directory with custom fonts to be installed
}
type TGetPerfDataResult = {
firstContentfulPaint: number,
firstMeaningfulPaint: number,
largestContentfulPaint: number,
domContentLoaded: number,
domInteractive: number,
threadTime: number,
scriptDuration: number,
layoutDuration: number,
recalcStyleDuration: number,
usedJsHeapSize: number,
}
const getPerfData: (options: TGetPerfDataOptions) => Promise<TGetPerfDataResult>
import { getPerfData } from 'perfa'
const perfData = await getPerfData({
entryPointPath: './App.tsx'
})
firstContentfulPaintFirst Contentful Paint measures the time from navigation to the time when the browser renders the first bit of content from the DOM. This is an important milestone for users because it provides feedback that the page is actually loading.
https://developers.google.com/web/tools/lighthouse/audits/first-contentful-paint
firstMeaningfulPaintFirst Meaningful Paint is essentially the paint after which the biggest above-the-fold layout change has happened, and web fonts have loaded.
https://developers.google.com/web/tools/lighthouse/audits/first-meaningful-paint
largestContentfulPaintLargest Contentful Paint is an important, user-centric metric for measuring perceived load speed because it marks the point in the page load timeline when the page's main content has likely loaded—a fast LCP helps reassure the user that the page is useful.
domContentLoadedThe DOMContentLoaded event fires when the initial HTML document has been completely loaded and parsed, without waiting for stylesheets, images, and subframes to finish loading.
https://developer.mozilla.org/en-US/docs/Web/API/Window/DOMContentLoaded_event
domInteractiveA timestamp representing the time value equal to the time immediately before the user agent sets the current document readiness of the current document to interactive.
threadTimeNot really documented, likely the time of the main thread "to run all the JavaScript in your page, as well as to perform layout, reflows, and garbage collection"
https://developer.mozilla.org/en-US/docs/Glossary/Main_thread
scriptDurationCombined duration of JavaScript execution.
https://github.com/puppeteer/puppeteer/blob/v2.1.1/docs/api.md#pagemetrics
layoutDurationCombined durations of all page layouts.
https://github.com/puppeteer/puppeteer/blob/v2.1.1/docs/api.md#pagemetrics
recalcStyleDurationCombined duration of all page style recalculations.
https://github.com/puppeteer/puppeteer/blob/v2.1.1/docs/api.md#pagemetrics
usedJsHeapSizeusedJsHeapSize is the total amount of memory being used by JS objects including V8 internal objects.
https://webplatform.github.io/docs/apis/timing/properties/memory/
FAQs
Measure React app performance using dockerized Chromium through [`xrom`](https://github.com/nextools/metarepo/tree/master/packages/xrom) lib.
We found that perfa demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.