
Security News
Cline CLI npm Package Compromised via Suspected Cache Poisoning Attack
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.
A simple way to analyze performance in JavaScript programs.
Install with npm
npm install perfalize
Use it in your program:
// require() works too.
import { perfalize, enable } from 'perfalize'
// this must be enabled once somewhere
// any instrumentations in un-enabled mode are discarded
if (process.env.PROFILE === '1') {
enable()
// if you want to override options, you can set that here
// only one option is supported right now, the minimum cutoff
// (in ms). All samples with a total time below this minimum
// will be omitted from the report.
enable({
// ignore any samples that didn't add up to at least this
// many ms, defaults to 1
minimum: 1,
})
}
// instrument your code
// this name should be unique to each sampling hook you create
const thingDone = perfalize('do thing')
doSomething()
thingDone()
// You can also pass it a promise or async function
// and it'll collect when finished
const done = perfalize('some promise action')
const promise = someAsyncFunction(args)
done(promise)
// the done() method returns whatever is passed to it,
// so you can do this if you have some slow action in
// the tail position
function someFunction() {
const done = perfalize('someFunction')
doSomething()
doSomethingElse()
return done(doSomeSlowThing())
}
// to instrument a whole function, you can do this:
import { perfalizeFn } from 'perfalize'
const someFunction = perfalizeFn('someFunction', () => {
doSomething()
doSomethingElse()
return doSomeSlowThing()
})
The goal of any performance analysis tool should be to have as little impact on the system under test as possible. So, not very much is tracked, and it just does a bit of basic arithmetic on each sample collected.
Perfalize tracks:
node --prof?In many cases, you definitely should! I'm a huge fan. This is somewhat of a different thing.
node --perf tracks everything in your program, all C++ and
JS. That's ideal for coverage, and can be very useful when
you're not sure if the bottleneck is even in your code. It also
provides a "bottoms up" view that is hard to do correctly with
manual perf sampling.
But, that can also be noisy, and sometimes overkill if you just want a simple debugging tool that you can turn on with an enviroment variable.
FAQs
Simple lightweight performance sampler
The npm package perfalize receives a total of 3 weekly downloads. As such, perfalize popularity was classified as not popular.
We found that perfalize demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
A compromised npm publish token was used to push a malicious postinstall script in cline@2.3.0, affecting the popular AI coding agent CLI with 90k weekly downloads.

Product
Socket is now scanning AI agent skills across multiple languages and ecosystems, detecting malicious behavior before developers install, starting with skills.sh's 60,000+ skills.

Product
Socket now supports PHP with full Composer and Packagist integration, enabling developers to search packages, generate SBOMs, and protect their PHP dependencies from supply chain threats.