@litko/yara-x 0.2.0 → 0.2.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (3) hide show
  1. package/README.md +34 -28
  2. package/index.d.ts +20 -161
  3. package/package.json +8 -5
package/README.md CHANGED
@@ -1,7 +1,5 @@
1
1
  # @litko/yara-x
2
2
 
3
- **v0.1.1**
4
-
5
3
  ## Features
6
4
 
7
5
  - High Performance: Built with [napi-rs](https://napi-rs.com) and [VirusTotal/yara-x](https://github.com/VirusTotal/yara-x)
@@ -363,31 +361,42 @@ if (warnings.length > 0) {
363
361
 
364
362
  ## Performance Benchmarks
365
363
 
366
- **Test Setup:**
364
+ `node-yara-x` delivers exceptional performance through intelligent scanner caching and optimized Rust implementation.
365
+
366
+ ### Benchmark Results
367
+
368
+ Test Environment: MacBook Pro M3 Max, 36GB RAM, Release build with LTO
369
+ Methodology: Statistical analysis across multiple iterations with percentile reporting
370
+
371
+ #### Scanner Creation Performance
367
372
 
368
- - **Hardware:** MacBook Pro (M3 Max, 36GB RAM)
369
- - **Test Data:** Generated data of varying sizes (small: 64 bytes, medium: 100KB, large: 10MB). See `__test__/benchmark.mjs` for data generation and benchmarking code.
370
- - The Large test file (10MB) is auto-generated, to prevent bloating the size of the repository.
373
+ | Rule Type | Mean | p50 | p95 | p99 |
374
+ | -------------- | ------ | ------ | ------ | ------ |
375
+ | Simple Rule | 2.44ms | 2.42ms | 2.67ms | 3.00ms |
376
+ | Complex Rule | 2.79ms | 2.78ms | 3.00ms | 3.26ms |
377
+ | Regex Rule | 8.63ms | 8.63ms | 8.91ms | 9.34ms |
378
+ | Multiple Rules | 2.42ms | 2.39ms | 2.69ms | 3.07ms |
371
379
 
372
- **Key Metrics (Averages):**
380
+ #### Scanning Performance by Data Size
373
381
 
374
- | Operation | Average Time | Iterations | p50 | p95 | p99 |
375
- | :---------------------------------------------- | -----------: | ---------: | -------: | -------: | -------: |
376
- | Scanner Creation (Simple Rule) | 1.675 ms | 100 | 1.547 ms | 2.318 ms | 2.657 ms |
377
- | Scanner Creation (Complex Rule) | 1.878 ms | 100 | 1.848 ms | 2.005 ms | 2.865 ms |
378
- | Scanner Creation (Regex Rule) | 2.447 ms | 100 | 2.444 ms | 2.473 ms | 2.569 ms |
379
- | Scanner Creation (Multiple Rules) | 1.497 ms | 100 | 1.488 ms | 1.547 ms | 1.819 ms |
380
- | Scanning Small Data (64 bytes, Simple Rule) | 0.145 ms | 1000 | 0.143 ms | 0.156 ms | 0.169 ms |
381
- | Scanning Medium Data (100KB, Simple Rule) | 0.151 ms | 100 | 0.146 ms | 0.179 ms | 0.205 ms |
382
- | Scanning Large Data (10MB, Simple Rule) | 0.347 ms | 10 | 0.340 ms | 0.394 ms | 0.394 ms |
383
- | Scanning Medium Data (100KB, Complex Rule) | 0.219 ms | 100 | 0.215 ms | 0.254 ms | 0.269 ms |
384
- | Scanning Medium Data (100KB, Regex Rule) | 0.156 ms | 100 | 0.152 ms | 0.182 ms | 0.210 ms |
385
- | Scanning Medium Data (100KB, Multiple Rules) | 0.218 ms | 100 | 0.212 ms | 0.261 ms | 0.353 ms |
386
- | Async Scanning Medium Data (100KB, Simple Rule) | 0.012 ms | 100 | 0.011 ms | 0.016 ms | 0.027ms |
387
- | Scanning with Variables | 0.143 ms | 1000 | 0.140 ms | 0.155 ms | 0.166 ms |
388
- | Scanning with Variables (Override at Scan Time) | 0.144 ms | 1000 | 0.142 ms | 0.158 ms | 0.175 ms |
382
+ | Data Size | Rule Type | Mean | Throughput |
383
+ | --------- | -------------- | ----- | ---------- |
384
+ | 64 bytes | Simple | 3μs | ~21 MB/s |
385
+ | 100KB | Simple | 6μs | ~16.7 GB/s |
386
+ | 100KB | Complex | 71μs | ~1.4 GB/s |
387
+ | 100KB | Regex | 7μs | ~14.3 GB/s |
388
+ | 100KB | Multiple Rules | 71μs | ~1.4 GB/s |
389
+ | 10MB | Simple | 196μs | ~51 GB/s |
389
390
 
390
- # API Reference
391
+ #### Advanced Features Performance
392
+
393
+ | Feature | Mean | Notes |
394
+ | ----------------- | ---- | -------------------------- |
395
+ | Variable Scanning | 1μs | Pre-compiled variables |
396
+ | Runtime Variables | 2μs | Variables set at scan time |
397
+ | Async Scanning | 12μs | Non-blocking operations |
398
+
399
+ ## API Reference
391
400
 
392
401
  ### Functions
393
402
 
@@ -395,7 +404,7 @@ if (warnings.length > 0) {
395
404
  - `compileToWasm(ruleSource: string, outputPath: string, options?: CompilerOptions)` - Compiles yara rules from a string to WASM file.
396
405
  - `compileFileToWasm(rulesPath: string, outputPath: string, options?: CompilerOptions)` - Compiles yara rules from a file to WASM file.
397
406
  - `validate(ruleSource: string, options?: CompilerOptions)` - Validates yara rules without executing them.
398
- - `create(options?: CompilerOptions)` - Creates an empty rules scanner to add rules incrementally.
407
+ - `create()` - Creates an empty rules scanner to add rules incrementally.
399
408
  - `fromFile(rulePath: string, options?: CompilerOptions)` - Compiles yara rules from a file.
400
409
 
401
410
  ### yarax Methods
@@ -409,10 +418,7 @@ if (warnings.length > 0) {
409
418
  - `emitWasmFileAsync(filePath: string)` - Emit compiled rules to WASM file asynchronously.
410
419
  - `addRuleSource(rules: string)` - Add rules from a string to an existing scanner.
411
420
  - `addRuleFile(filePath: string)` - Add rules from a file to an existing scanner.
412
-
413
- ### Rule Validation
414
-
415
- - `validate(rules: string, options?: CompilerOptions)` - Validate yara rules without executing them.
421
+ - `defineVariable(name: string, value: string)` - Define a variable for the YARA compiler.
416
422
 
417
423
  ## Licenses
418
424
 
package/index.d.ts CHANGED
@@ -1,73 +1,25 @@
1
1
  /* auto-generated by NAPI-RS */
2
2
  /* eslint-disable */
3
- /**
4
- * YaraX struct represents the YARA rules and their associated data.
5
- * It contains the compiled rules, source code, warnings, and variables.
6
- *
7
- * See [yara_x::Rules](https://docs.rs/yara-x/latest/yara_x/struct.Rules.html) for more details.
8
- */
3
+ /** YaraX struct represents the YARA rules and their associated data. */
9
4
  export declare class YaraX {
10
5
  getWarnings(): Array<CompilerWarning>
11
- /**
12
- * Scans the provided data using the compiled YARA rules.
13
- * This function takes the scanned data and an optional object of variables,
14
- * and returns a vector of RuleMatch representing the matching rules found during the scan.
15
- */
6
+ /** Scans the provided data using the compiled YARA rules. */
16
7
  scan(data: Buffer, variables?: Record<string, string | number>): Array<RuleMatch>
17
- /**
18
- * Scans a file using the compiled YARA rules.
19
- * This function takes the file path and an optional object of variables,
20
- * and returns a vector of RuleMatch representing the matching rules found during the scan.
21
- */
8
+ /** Scans a file using the compiled YARA rules. */
22
9
  scanFile(filePath: string, variables?: Record<string, string | number>): Array<RuleMatch>
23
- /**
24
- * Emits a WASM file from the compiled YARA rules.
25
- * This function takes the output path and writes the compiled rules to a WASM file.
26
- */
10
+ /** Emits a WASM file from the compiled YARA rules. */
27
11
  emitWasmFile(outputPath: string): void
28
- /**
29
- * Scans the provided data asynchronously using the compiled YARA rules.
30
- * This function takes the scanned data and an optional object of variables,
31
- * and returns an AsyncTask that will resolve to a vector of RuleMatch representing the matching
32
- * rules found during the scan.
33
- *
34
- * This allows for non-blocking scanning of data, which can be useful for large datasets or
35
- * performance-critical applications.
36
- */
12
+ /** Scans the provided data asynchronously using the compiled YARA rules. */
37
13
  scanAsync(data: Buffer, variables?: object | undefined | null): Promise<unknown>
38
- /**
39
- * Scans a file asynchronously using the compiled YARA rules.
40
- * This function takes the file path and an optional object of variables,
41
- * and returns an AsyncTask that will resolve to a vector of RuleMatch representing the matching
42
- * rules found during the scan.
43
- *
44
- * This allows for non-blocking scanning of files, which can be useful for large files or
45
- * performance-critical applications.
46
- */
14
+ /** Scans a file asynchronously using the compiled YARA rules. */
47
15
  scanFileAsync(filePath: string, variables?: object | undefined | null): Promise<unknown>
48
- /**
49
- * Emits a WASM file asynchronously from the compiled YARA rules.
50
- * This function takes the output path
51
- * and returns an AsyncTask that will resolve when the WASM file is successfully emitted.
52
- */
16
+ /** Emits a WASM file asynchronously from the compiled YARA rules. */
53
17
  emitWasmFileAsync(outputPath: string): Promise<unknown>
54
- /**
55
- * Adds a rule source to the YARA compiler.
56
- * This function takes a rule source string,
57
- * compiles it, and updates the YaraX instance with the new rules.
58
- */
18
+ /** Adds a rule source to the YARA compiler. */
59
19
  addRuleSource(ruleSource: string): void
60
- /**
61
- * Adds a rule file to the YARA compiler.
62
- * This function takes a file path,
63
- * reads the file content, and adds it to the YaraX instance.
64
- */
20
+ /** Adds a rule file to the YARA compiler. */
65
21
  addRuleFile(filePath: string): void
66
- /**
67
- * Defines a variable for the YARA compiler.
68
- * This function takes a variable name and value,
69
- * and adds it to the YaraX instance.
70
- */
22
+ /** Defines a variable for the YARA compiler. */
71
23
  defineVariable(name: string, value: string): void
72
24
  }
73
25
 
@@ -81,41 +33,13 @@ export interface BannedModule {
81
33
  errorMessage: string
82
34
  }
83
35
 
84
- /**
85
- * Compiles a YARA rule source string and returns a YaraX instance with the compiled rules.
86
- *
87
- * Exported as `compile` in the NAPI interface.
88
- *
89
- * Example
90
- *
91
- * ```javascript
92
- * const { compile } = require('your_yara_module');
93
- * const yarax = compile('rule example { strings: $a = "example" condition: $a }');
94
- * ```
95
- */
36
+ /** Compiles a YARA rule source string and returns a YaraX instance with the compiled rules. */
96
37
  export declare function compile(ruleSource: string, options?: CompilerOptions | undefined | null): YaraX
97
38
 
98
- /**
99
- * Compiles a YARA rule file to a WASM file.
100
- *
101
- * Exported as `compileFileToWasm` in the NAPI interface.
102
- *
103
- * Example
104
- *
105
- * ```javascript
106
- * const { compileFileToWasm } = require('your_yara_module');
107
- * compileFileToWasm('path/to/rule_file.yar', 'output.wasm');
108
- * ```
109
- */
39
+ /** Compiles a YARA rule file to a WASM file. */
110
40
  export declare function compileFileToWasm(rulePath: string, outputPath: string, options?: CompilerOptions | undefined | null): void
111
41
 
112
- /**
113
- * CompilerError struct represents an error generated by the YARA compiler.
114
- *
115
- * See
116
- * [yara_x::CompileError](https://docs.rs/yara-x/latest/yara_x/errors/enum.CompileError.html)
117
- * for more details.
118
- */
42
+ /** CompilerError struct represents an error generated by the YARA compiler. */
119
43
  export interface CompilerError {
120
44
  /** The code of the error. */
121
45
  code: string
@@ -129,10 +53,7 @@ export interface CompilerError {
129
53
  column?: number
130
54
  }
131
55
 
132
- /**
133
- * CompileResult struct represents the result of compiling YARA rules.
134
- * It contains any warnings or errors generated during the compilation process.
135
- */
56
+ /** CompileResult struct represents the result of compiling YARA rules. */
136
57
  export interface CompileResult {
137
58
  /** Any warnings generated during the compilation process. */
138
59
  warnings: Array<CompilerWarning>
@@ -140,12 +61,7 @@ export interface CompileResult {
140
61
  errors: Array<CompilerError>
141
62
  }
142
63
 
143
- /**
144
- * CompilerOptions struct represents the options for the YARA compiler.
145
- *
146
- * See [yara_x::Compiler](https://docs.rs/yara-x/latest/yara_x/struct.Compiler.html) for more
147
- * details.
148
- */
64
+ /** CompilerOptions struct represents the options for the YARA compiler. */
149
65
  export interface CompilerOptions {
150
66
  /** Defines global variables for the YARA rules. */
151
67
  defineVariables?: object
@@ -165,12 +81,7 @@ export interface CompilerOptions {
165
81
  errorOnSlowLoop?: boolean
166
82
  }
167
83
 
168
- /**
169
- * CompilerWarning struct represents a warning generated by the YARA compiler.
170
- *
171
- * See [yara_x::CompilerWarning](https://docs.rs/yara-x/latest/yara_x/warnings/enum.Warning.html)
172
- * for more details.
173
- */
84
+ /** CompilerWarning struct represents a warning generated by the YARA compiler. */
174
85
  export interface CompilerWarning {
175
86
  /** The code of the warning. */
176
87
  code: string
@@ -184,52 +95,13 @@ export interface CompilerWarning {
184
95
  column?: number
185
96
  }
186
97
 
187
- /**
188
- * Compiles a YARA rule source string to a WASM file.
189
- *
190
- * Exported as `compileToWasm` in the NAPI interface.
191
- *
192
- * Example
193
- *
194
- * ```javascript
195
- * const { compileToWasm } = require('your_yara_module');
196
- * compileToWasm('rule example { strings: $a = "example" condition: $a }', 'output.wasm');
197
- * ```
198
- */
98
+ /** Compiles a YARA rule source string to a WASM file. */
199
99
  export declare function compileToWasm(ruleSource: string, outputPath: string, options?: CompilerOptions | undefined | null): void
200
100
 
201
- /**
202
- * Creates a new YaraX instance with empty rules and no source code.
203
- *
204
- * Exported as `create` in the NAPI interface.
205
- *
206
- * Example
207
- *
208
- * ```javascript
209
- * const { create } = require('your_yara_module');
210
- * const yarax = create();
211
- *
212
- * // Now you can add rules or compile them later
213
- *
214
- * yarax.addRuleSource('rule example { strings: $a = "example" condition: $a }');
215
- * yarax.addRuleFile('path/to/rule_file.yar');
216
- * yarax.defineVariable('myVar', 'myValue');
217
- * ```
218
- */
101
+ /** Creates a new YaraX instance with empty rules and no source code. */
219
102
  export declare function create(): YaraX
220
103
 
221
- /**
222
- * Creates a new YaraX instance from a file containing YARA rules.
223
- *
224
- * Exported as `fromFile` in the NAPI interface.
225
- *
226
- * Example
227
- *
228
- * ```javascript
229
- * const { fromFile } = require('your_yara_module');
230
- * const yarax = fromFile('path/to/rule_file.yar');
231
- * ```
232
- */
104
+ /** Creates a new YaraX instance from a file containing YARA rules. */
233
105
  export declare function fromFile(rulePath: string, options?: CompilerOptions | undefined | null): YaraX
234
106
 
235
107
  /** MatchData struct represents a match found by a YARA rule. */
@@ -244,11 +116,7 @@ export interface MatchData {
244
116
  identifier: string
245
117
  }
246
118
 
247
- /**
248
- * RuleMatch struct represents a matching rule found during scanning.
249
- *
250
- * See [yara_::Match](https://docs.rs/yara-x/latest/yara_x/struct.Match.html) for more details.
251
- */
119
+ /** RuleMatch struct represents a matching rule found during scanning. */
252
120
  export interface RuleMatch {
253
121
  /** The identifier of the rule that matched. */
254
122
  ruleIdentifier: string
@@ -265,14 +133,5 @@ export interface RuleMatch {
265
133
  /**
266
134
  * Compiles a YARA rule source string and returns any warnings or errors generated during the
267
135
  * compilation process.
268
- *
269
- * Exported as `validate` in the NAPI interface.
270
- *
271
- * Example
272
- *
273
- * ```javascript
274
- * const { validate } = require('your_yara_module');
275
- * const result = validate('rule example { strings: $a = "example" condition: $a }');
276
- * ```
277
136
  */
278
137
  export declare function validate(ruleSource: string, options?: CompilerOptions | undefined | null): CompileResult
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@litko/yara-x",
3
- "version": "0.2.0",
3
+ "version": "0.2.1",
4
4
  "main": "index.js",
5
5
  "types": "index.d.ts",
6
6
  "packageManager": "pnpm@10.13.1",
@@ -41,7 +41,10 @@
41
41
  "universal": "napi universal",
42
42
  "version": "napi version",
43
43
  "test": "node --test __test__/index.spec.mjs",
44
- "benchmark": "node __test__/benchmark.mjs"
44
+ "benchmark": "node __test__/benchmark.mjs",
45
+ "profile": "node --expose-gc __test__/run-profiling.mjs",
46
+ "profile:baseline": "node --expose-gc __test__/run-profiling.mjs --baseline",
47
+ "profile:compare": "node --expose-gc __test__/run-profiling.mjs --compare __test__/baseline-performance.json"
45
48
  },
46
49
  "files": [
47
50
  "index.js",
@@ -56,8 +59,8 @@
56
59
  "rust"
57
60
  ],
58
61
  "optionalDependencies": {
59
- "@litko/yara-x-darwin-x64": "0.2.0",
60
- "@litko/yara-x-darwin-arm64": "0.2.0",
61
- "@litko/yara-x-linux-x64-gnu": "0.2.0"
62
+ "@litko/yara-x-darwin-x64": "0.2.1",
63
+ "@litko/yara-x-darwin-arm64": "0.2.1",
64
+ "@litko/yara-x-linux-x64-gnu": "0.2.1"
62
65
  }
63
66
  }