Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-analyzer
Advanced tools
Mad metrics for your rollup bundles, know all the things
$ npm install --save-dev rollup-plugin-analyzer
import analyze from 'rollup-plugin-analyzer'
const analyze = require('rollup-plugin-analyzer')
export default {
entry: 'module.js',
dest: 'index.js',
format: 'cjs',
plugins: [analyze()]
}
rollup({
entry: 'main.js',
plugins: [analyze()]
}).then(...)
const limitBytes = 1e6
const onAnalysis = ({ bundleSize }) => {
if (bundleSize < limitBytes) return
console.log(`Bundle size exceeds ${limitBytes} bytes: ${bundleSize} bytes`)
return process.exit(1)
}
rollup({
entry: 'main.js',
plugins: [analyze({ onAnalysis, skipFormatted: true })]
}).then(...)
logged to console on rollup completion
-----------------------------
Rollup File Analysis
-----------------------------
bundle size: 2.809 KB
original size: 11.436 KB
code reduction: 75.44 %
module count: 5
█████████████████████████████████████████████░░░░░
file: /virtual-insanity.js
bundle space: 90.64 %
rendered size: 2.546 KB
original size: 2.57 KB
code reduction: 0.93 %
dependents: 1
- /jamiroquai.js
██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
file: /bundle-a.js
bundle space: 4.27 %
rendered size: 120 Bytes
original size: 309 Bytes
code reduction: 61.17 %
dependents: 0
█░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░
file: /jamiroquai.js
bundle space: 2.95 %
rendered size: 83 Bytes
original size: 169 Bytes
code reduction: 50.89 %
dependents: 1
- /the-alphabet-but-incomplete.js
...
summaryOnly
enabled)-----------------------------
Rollup File Analysis
-----------------------------
bundle size: 2.809 KB
original size: 11.436 KB
code reduction: 75.44 %
module count: 5
/virtual-insanity.js
█████████████████████████████████████████████░░░░░ 90.64 % (2.546 KB)
/bundle-a.js
██░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 4.27 % (120 Bytes)
/jamiroquai.js
█░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 2.95 % (83 Bytes)
/the-alphabet-but-incomplete.js
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 1.17 % (33 Bytes)
/the-declaration-of-independence.js
░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░░ 0.96 % (27 Bytes)
false
null
null
filterSummary
to true
module
object specified below, should return booleanfalse
true
the filter
and limit
options will also remove any filtered out module data from the summaryprocess.cwd()
false
false
false
false
null
null
(id) => id.replace(/^\0(?:commonjs-proxy:)?/, '')
null
module
analysis objects
This module is geared towards the details of the individual modules that make up the bundle and their relative impact to bundle size. That's a detailed way of saying, it doesn't really care about size on disk. There are other options which focus on size on disk as well as delivery size which can be used alongside this module (or in place of if your concern is not per module impact). In particular rollup-plugin-size-snapshot seems like a great option for that.
Getting a bit further into the details, rather than just intent, of why the reported size differs from that on disk. We get the module data from Rollup which reports it after chunk (module) resolution and tree-shaking, but before post-processing (such as minification and compression). We then add the sizes of each of those modules together, this is the bundle size
that we report.
That means it won't account for post-processing from other plugins and also won't account for post-processing by Rollup itself, which includes boilerplate / shims depending on what the output format is (CJS, ESM, iife, etc...).
Rollup allows you to output to multiple files. If you are outputting to multiple files you will get a distinct analysis for each output file. Each analysis will contain data on the files imported by the respective target.
MIT © Andrew Carpenter
FAQs
Mad metrics for your rollup bundles, know all the things
The npm package rollup-plugin-analyzer receives a total of 45,094 weekly downloads. As such, rollup-plugin-analyzer popularity was classified as popular.
We found that rollup-plugin-analyzer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.