
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Last Tested on Node 14 & Chrome 80+
I was reading a blog/wiki article at https://github.com/petkaantonov/bluebird/wiki/Optimization-killers and it presents some really low level diagnostic commands that I was totally unaware of; and so I found them to be totally awesome in scope for several things I do. The V8 engine has a large array of commands that you can call that can get and/or set status in the actual v8 engine. This library is my attempt to make my life a lot easier and eliminate the errors in trying to use the v8 native commands. These low level commands allow you access to tell the v8 engine to optimize a routine and then find out if a routine can/is optimized.
Now, you can call the v8 native commands directly (for example %CollectGarbage()); however if you forget to use the --allow-natives-syntax then the v8 engine will immediately stop parsing the file as the v8 commands all start with a '%' which is invalid JavaScript... What this library does is it is a simple wrapper that wraps those calls; so that I can do (v8.CollectGarbage()). If you forgot the --allow-natives-syntax it will still run your code fine; it just won't do anything.
In the examples folder is a browser example; to show you how it works in Chrome/Chromium (chrome --js-flags="--allow-natives-syntax" browser.html). You can run it in a non-v8 browser and it will just use the dummy shim.
In addition there is a NodeJS example to show you the same support in NodeJS. (node --allow-natives-syntax node.js)
Please note the examples and helper commands can show you how to use a good chunk of the optimization, general and Memory calls in the library. If someone wants to work up some examples using the variable/object information commands; they would gladly be accepted!
npm install v8-natives
setFlagsgetV8VersionfunctionGetName = getFunctionName<script src="v8-browser.js" onload="waitForV8(some_callback)"></script>
<script>function some_callback() {
v8.collectGarbage();
/* more v8.commands */}
</script>
var v8 = require('v8-natives');
v8.collectGarbage();
/* more v8 commands */
optimizedFunctionOnNextCall(func) needs the function ran before it can tag it for optimization. So the procedure is:
v8 Internal function list has changed the following functions have been removed:
v8 Renamed:
FAQs
A simple API for accessing v8 native instructions
The npm package v8-natives receives a total of 11,624 weekly downloads. As such, v8-natives popularity was classified as popular.
We found that v8-natives demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.