--- title: "The ins and outs of 'bin' scripts" publication: "Node Weekly" issue: 452 published_at: "2022-09-01" canonical_url: "https://nodeweekly.com/issues/452" --- Plus in-process fuzzing for Node apps, Heroku's new roadmap, and making a Twitter bot. | #​452 — September 1, 2022 [Read on the Web](https://nodeweekly.com/issues/452) ![Node.js Weekly](https://res.cloudinary.com/cpress/image/upload/v1653576619/lgfqinzbdqttwmhvljxb.png) [![\](https://res.cloudinary.com/cpress/image/upload/w_1280,e_sharpen:60/iks1e8yrofgxoehni5tb.jpg)](https://github.com/tinylibs/tinybench) [Tinybench: A Tiny and Simple Benchmarking Library](https://github.com/tinylibs/tinybench) — No dependencies, but uses whatever precise timing capabilities are available (e.g. `process.hrtime`). You can then benchmark whatever functions you want, specify how long or how many times to benchmark for, and get a variety of stats in return. Tinylibs [Installing and Running `bin` Scripts](https://2ality.com/2022/08/installing-nodejs-bin-scripts.html) — npm packages can specify which shell scripts/runnable files they provide by way of the package.json `bin` property. Dr. Axel digs pretty deep, here, into how it all works and the two approaches for installing packages offering such `bin` scripts. Dr. Axel Rauschmayer [![\](https://copm.s3.amazonaws.com/0c1b0ad6.png)](https://go.snyk.io/capture-the-flag-101-workshop.html?utm_campaign=CTF101-Sept-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=capture-the-flag-101-workshop) [Virtual Capture the Flag 101 Workshop: September 14 | 11am EDT](https://go.snyk.io/capture-the-flag-101-workshop.html?utm_campaign=CTF101-Sept-2022&utm_medium=Paid-Email&utm_source=Cooperpress-Node-Weekly&utm_content=capture-the-flag-101-workshop) — Join Snyk in a hands-on, virtual workshop to learn how to solve Capture the Flag (CTF) challenges and build the security skills and experience you need to compete in CTFs. Save your spot today. Snyk sponsor [Jazzer.js: In-Process 'Fuzzing' for Node Apps](https://www.code-intelligence.com/blog/jazzer.js) — Inspired by a similar named JVM-based fuzzer ([Jazzer](https://github.com/CodeIntelligenceTesting/jazzer)), Jazzer.js is a libFuzzer-based in-process fuzzer for Node apps. It doesn’t just generate fuzzed inputs, but detects when new code paths are reached and adjusts input to reach even deeper code paths. [GitHub repo](https://github.com/CodeIntelligenceTesting/jazzer.js). Code Intelligence [Heroku Reveals Roadmap; Will Drop Free Plans](https://blog.heroku.com/next-chapter) — Much conjecture has swirled around the state of Heroku, a commonly used PaaS for hosting Node apps, and now its owner has responded with a slightly underwhelming roadmap which sadly includes the discontinuation of its popular free plans this November. So if you have apps on Heroku, it’s worth checking in on how they’ll fare and, perhaps, [taking a look at some alternatives](https://github.com/DmitryScaletta/free-heroku-alternatives). Heroku [Four Ways to Minimize Your Dependencies](https://blog.appsignal.com/2022/08/31/4-ways-to-minimize-your-dependencies-in-nodejs.html) — After numerous npm supply chain stories (and vulnerabilities thereof) or looking at how large that `node_modules` folder has ended up, keeping your dependencies to a minimum may appeal to you. Dmitry has a few ideas, but you might not like them. Dmitry Kudryavtsev [Instant Real-Time Tracking and Monitoring for Your Tests](https://buildkite.com/test-analytics?utm_campaign=CPress&utm_source=ppc&utm_medium=Node-Weekly&utm_term=Test-Analytics) Buildkite Test Analytics sponsor [Building a Secure API with gRPC and Node](https://snyk.io/blog/building-a-secure-api-with-grpc/) — A walkthrough of allowing two Node apps to communicate over the HTTP/2 and protocol buffer based gRPC mechanism. Vitalis Ogbonna (Snyk) [Making a Twitter Bot in the Year 2022 with Node.js](https://cmdcolin.github.io/posts/2022-08-26-twitterbot) Colin Diesh 🛠 Code & Tools [jscythe: Misusing the Node.js Inspector Mechanism to Run Arbitrary Code](https://github.com/evilsocket/jscythe) — An interesting proof of concept of a way to use Node’s inspector mechanism to force any Node/Electron/V8-based process to run arbitrary JavaScript code, even if their own debugging capabilities are disabled. Simone Margaritelli [TestCafe v2.0.0: Automated End-to-End Testing Tool](https://testcafe.io/404018/release-notes/framework/2022-8-31-testcafe-v2-0-0-released) — A popular and long standing testing tool reaches a new milestone and, notably, is the first update to include breaking changes.. so if you’re a user, pay close attention. Developer Express Inc. [Detect Latency in Your Code Without Affecting Node App Performance](https://www.datadoghq.com/dg/apm/debugging-node/?utm_source=advertisement&utm_medium=newsletter&utm_campaign=dg-cooperpress-applications-ww-node-b-debugging) Datadog sponsor [Uncino: Fast, Tiny and Solid Hooks System](https://github.com/riktar/uncino) — The latest Node package with an Italian name (don’t forget Undici!) provides a hooks system inspired by the one in Wordpress (not to be confused with React-style hooks). Riccardo Tartaglia [Dynamoose 3.0](https://github.com/dynamoose/dynamoose/releases/tag/v3.0.0) – Modeling tool for DynamoDB. Now uses AWS-SDK v3. [Mercurius 10.5](https://github.com/mercurius-js/mercurius) – Implement GraphQL servers on Fastify. [graphql-request 5.0](https://github.com/prisma-labs/graphql-request) – Minimal GraphQL client. [Clinic.js 12.0](https://github.com/clinicjs/node-clinic) – Node performance profiling suite. [fastest-validator 1.15](https://github.com/icebob/fastest-validator) – Fast data validation library. [env-var 7.2](https://github.com/evanshortiss/env-var) – Verification and sanitization for env variables. [grammY 1.11](https://github.com/grammyjs/grammY) – Telegram bot framework. [Faker 7.5](https://github.com/faker-js/faker) – Generate massive amounts of fake data. [Prisma 4.3](https://github.com/prisma/prisma/releases/tag/4.3.0) – The next-gen ORM for Node & TypeScript. [Middy 3.3](https://github.com/middyjs/middy) – Node middleware engine for AWS Lambda. 💻 Jobs [Senior JavaScript/TypeScript Developer (Remote or Warsaw) 🇵🇱](https://cksource.com/careers/?utm_source=jsweekly&utm_medium=email&utm_campaign=sep2#senior-javascript-typescript-developer) — Join CKEditor team to develop an Open Source project used by millions of users around the world 🚀and realize your true potential. CKEditor [Find Tech Jobs with Hired](https://hired.com/join/?utm_source=newsletter&utm_medium=sponsor&utm_campaign=%28b2c%29%28l-all%29%28r-all%29%28cooper-nodeweekly%29&utm_content=find-your-next-job) — Create a profile on Hired to connect with hiring managers at growing startups and Fortune 500 companies. It's free for job-seekers. Hired **Got a link for us?** Reply and tell us. We can't include everything but we'll look at anything you send. _Thanks!_ --- **Got a new address?** You can [change your email here](https://nodeweekly.com/edit_subscription/*|UID|*). --- **Want to stop this email?** [Click here to say goodbye](https://nodeweekly.com/leave/*|UID|*). --- **Want even more newsletters?** Perhaps check out [JavaScript Weekly](https://javascriptweekly.com/), [React Status](https://react.statuscode.com/) or [Frontend Focus](https://frontendfoc.us) as well :-) --- **Want to sponsor?** Email `[kristina@cooperpress.com](mailto:kristina@cooperpress.com)` for details. --- Published by Cooper Press Ltd. Fairfield Enterprise Centre, Louth, LN11 0LS, United Kingdom [Stop getting this newsletter.](https://nodeweekly.com/leave/*|UID|*)