cli VS undici

📢 By the way NodeSecure CLI has a first-class support of the scorecard.

Those information are visible in the NodeSecure CLI interface:

@nodesecure/cli, a CLI that allow you to deeply analyze the dependency tree of a given package or local Node.js project

Fun fact: its first contribution 🐤 on NodeSecure was also on the old version of the code Scanner that managed vulnerabilities.

When NodeSecure was a single project the AST analysis was at most a few hundred lines in two or three JavaScript files. All the logic was coded with if and else conditions directly in the walker 🙈.

View on GitHub

NodeSecure can now detect packages created by Marak and it will generate a global warning ⚠️.

After more than ten long months of work we are finally there 😵! Version 0.9.0 has been released on npm 🚀.

Nsecure

Yeah: interestingly, they had a test for the biggest category of frame, but not for the two other categories: https://github.com/nodejs/undici/blob/main/test/websocket/se...

The test I contributed is very specific to the frame fix I made, but I should probably go back and contribute more tests in send.js that test other lengths too.

The native fetch in Node.js 18 is based on undici.

Sadly, Undici's slow. Reference issue.

Did you try just using the http lib, or even axios/node-fetch? The fetch API in node is very new and looks like there have been concerns about its performance: https://github.com/nodejs/undici/issues/1203

A library that can be handy is Undici - a great HTTP/1.1 client, see here where they apparently added unix:// support: https://github.com/nodejs/undici/pull/226

Afterwards, create your new project and install our lone requirement [undici](https://github.com/nodejs/undici) to make HTTP requests in Node.js by running:

Test coverage currently sits at 89%, hopefully will be stable soon.

undici

We implemented fetch API operation with Node without the need for any library imports. The thing to note that under the hood that the fetch implementation is done based on another HTTP client, undici, which is actually a HTTP client written specifically for Node.js. It is an HTTP 1.1 only client.

> ...enough insights of how much better/faster Deno is

We moved our Deno project to Node because of lack of lower-level APIs on their Conn interfaces [0][1], but otherwise for our use-case (lots of tiny HTTPS connections) Deno absolutely blew Node out-of-the-water. Even at p50 (100tps) Deno (v1.18) was 10x faster than Node (v17.x) [2]

RAM wise, I found Deno (v1.18+) use 10M or so higher for the same code-base.

[0] https://github.com/denoland/deno/issues/13636

[1] https://github.com/denoland/deno/issues/9109

[2] https://github.com/nodejs/undici/issues/1203#issuecomment-10...