
Security News
OWASP 2025 Top 10 Adds Software Supply Chain Failures, Ranked Top Community Concern
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.
rollup-plugin-bundle-stats
Advanced tools
In-depth bundle analyzer for rollup(bundle size, assets, modules, packages)
Demos: Bundle analysis comparison · Bundle analysis
Analyze rollup/rolldown bundle stats(bundle size, assets, modules, packages) and compare the results between different builds.
- Bundle size and totals by file type(css, js, img, etc)
- Insights: duplicate packages, new packages
- Initial JS/CSS, Cache invalidation, and other bundle metrics
- Assets report (entrypoint, initial, types, changed, delta)
- Modules report (changed, delta, chunks, duplicate count and percentage)
- Packages report (count, duplicate, changed, delta)
:star: Side by side comparison for multiple builds
npm install --dev rollup-plugin-bundle-stats
or
yarn add --dev rollup-plugin-bundle-stats
// vite.config.js
const { bundleStats } = require('rollup-plugin-bundle-stats');
module.exports = {
...,
build: {
rollupOptions: {
output: {
assetFileNames: 'assets/[name].[hash][extname]',
chunkFileNames: 'assets/[name].[hash].js',
entryFileNames: 'assets/[name].[hash].js',
},
},
},
plugins: [
bundleStats()
]
};
// rollup.config.js
const { bundleStats } = require('rollup-plugin-bundle-stats');
module.exports = {
...,
output: {
assetFileNames: 'assets/[name].[hash][extname]',
chunkFileNames: 'assets/[name].[hash].js',
entryFileNames: 'assets/[name].[hash].js',
},
plugins: [
bundleStats()
]
};
// rolldown.config.js
import { defineConfig } from 'rolldown';
import { bundleStats } from 'rollup-plugin-bundle-stats';
export default defineConfig({
...,
output: {
assetFileNames: 'assets/[name].[hash][extname]',
chunkFileNames: 'assets/[name].[hash].js',
entryFileNames: 'assets/[name].[hash].js',
},
plugins: [
bundleStats()
]
});
How to configure Vite for better debugging and monitoring
compare - use local saved stats for comparison (default true).baseline - save current webpack stats as baseline (default false).baselineFilepath - baseline absolute filepath or relative filepath to output.dir (default 'node_modules/.cache/bundle-stats/baseline.json')html - output html report (default true).json - output json report (default false).outDir - output directory inside rollup output director output.dir (default '').silent - stop logging info and only log warning and error (default false).In compare mode, the metrics are compared against an existing(node_modules/.cache/bundle-stats/baseline.json) rollup stats file(baseline). To generate the baseline webpack stats, set BUNDLE_STATS_BASELINE environmental variable to true or set the plugin baseline option to true:
# Checkout to the branch/tag/commit where you want to generate the baseline
$ git checkout master
# Build your application with BUNDLE_STATS_BASELINE environmental variable
$ BUNDLE_STATS_BASELINE=true npm run build
# Checkout to the working branch/tag/commit
$ git checkout MY_FEATURE_BRANCH
# Build your application
$ npm run build
The option can be disabled by setting the plugin compare option to false.
bundle-statsCLI to generate bundle stats report.
bundle-stats-webpack-pluginWebpack plugin to generate bundle stats report for webpack/rspack.
gatsby-plugin-bundle-statsGatsby plugin for bundle-stats.
next-plugin-bundle-statsNext.js plugin for bundle-stats.
Standalone web application to compare Webpack/Lighthouse/Browsertime stats.
Github Action that generates bundle-stats reports.
FAQs
In-depth bundle analyzer for rollup(bundle size, assets, modules, packages)
The npm package rollup-plugin-bundle-stats receives a total of 37,721 weekly downloads. As such, rollup-plugin-bundle-stats popularity was classified as popular.
We found that rollup-plugin-bundle-stats demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
OWASP’s 2025 Top 10 introduces Software Supply Chain Failures as a new category, reflecting rising concern over dependency and build system risks.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.