Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
rollup-plugin-bundle-stats
Advanced tools
In-depth bundle analyzer for rollup(bundle size, assets, modules, packages)
Demos: Bundle analysis comparison · Bundle analysis
Analyze rollup stats(bundle size, assets, modules, packages) and compare the results between different builds.
- Bundle size and totals by file type(css, js, img, etc)
- Insights: duplicate packages, new packages
- Initial JS/CSS, Cache invalidation, and other bundle metrics
- Assets report (entrypoint, initial, types, changed, delta)
- Modules report (changed, delta, chunks, duplicate count and percentage)
- Packages report (count, duplicate, changed, delta)
:star: Side by side comparison for multiple builds
npm install --dev rollup-plugin-bundle-stats
or
yarn add --dev rollup-plugin-bundle-stats
// rollup.config.js
const { bundleStats } = require('rollup-plugin-bundle-stats');
module.exports = {
...,
output: {
assetFileNames: 'assets/[name].[hash][extname]',
chunkFileNames: 'assets/[name].[hash].js',
entryFileNames: 'assets/[name].[hash].js',
},
plugins: [
bundleStats()
]
};
// vite.config.js
const { bundleStats } = require('rollup-plugin-bundle-stats');
module.exports = {
...,
build: {
rollupOptions: {
output: {
assetFileNames: 'assets/[name].[hash][extname]',
chunkFileNames: 'assets/[name].[hash].js',
entryFileNames: 'assets/[name].[hash].js',
},
},
},
plugins: [
bundleStats()
]
};
How to configure Vite for better debugging and monitoring
compare
- use local saved stats for comparison (default true
).baseline
- save current webpack stats as baseline (default false
).baselineFilepath
- baseline absolute filepath or relative filepath to output.dir
(default 'node_modules/.cache/bundle-stats/baseline.json')html
- output html report (default true
).json
- output json report (default false
).outDir
- output directory inside rollup output director output.dir
(default ''
).silent
- stop logging info and only log warning and error (default false
).In compare
mode, the metrics are compared against an existing(node_modules/.cache/bundle-stats/baseline.json
) rollup stats file(baseline). To generate the baseline webpack stats, set BUNDLE_STATS_BASELINE
environmental variable to true
or set the plugin baseline
option to true
:
# Checkout to the branch/tag/commit where you want to generate the baseline
$ git checkout master
# Build your application with BUNDLE_STATS_BASELINE environmental variable
$ BUNDLE_STATS_BASELINE=true npm run build
# Checkout to the working branch/tag/commit
$ git checkout MY_FEATURE_BRANCH
# Build your application
$ npm run build
The option can be disabled by setting the plugin compare
option to false
.
bundle-stats
CLI to generate bundle stats report.
bundle-stats-webpack-plugin
Webpack plugin to generate bundle stats report.
gatsby-plugin-bundle-stats
Gatsby plugin for bundle-stats.
next-plugin-bundle-stats
Next.js plugin for bundle-stats.
Standalone web application to compare Webpack/Lighthouse/Browsertime stats.
Github Action that generates bundle-stats reports.
FAQs
In-depth bundle analyzer for rollup(bundle size, assets, modules, packages)
The npm package rollup-plugin-bundle-stats receives a total of 17,900 weekly downloads. As such, rollup-plugin-bundle-stats popularity was classified as popular.
We found that rollup-plugin-bundle-stats demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.