# Performance & scale

Published articles for Performance & scale.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## How to protect an npm package from supply chain attacks

DevFeed: [How to protect an npm package from supply chain attacks](<https://devfeed.tech/articles/the-secure-way-to-release-an-npm-package-in-2026-19792.md>)

Original publisher: [Read original article](<https://evilmartians.com/chronicles/the-secure-way-to-release-an-npm-package>)

Author: Travis Turner (richardturner@evilmartians.com)

Published: 2026-07-28T00:00:00Z

Content type: tutorial

Language: en

Sources: [Evil Martians](<https://devfeed.tech/sources/evil-martians.md>)

Topics: [npm](<https://devfeed.tech/topics/npm.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Security](<https://devfeed.tech/topics/security.md>), [ci](<https://devfeed.tech/topics/ci.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [ci](<https://devfeed.tech/tags/ci.md>), [developer-community](<https://devfeed.tech/tags/developer-community.md>), [dx](<https://devfeed.tech/tags/dx.md>), [github](<https://devfeed.tech/tags/github.md>), [how-to](<https://devfeed.tech/tags/how-to.md>), [javascript](<https://devfeed.tech/tags/javascript.md>), [monorepo](<https://devfeed.tech/tags/monorepo.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [performance-scale](<https://devfeed.tech/tags/performance-scale.md>), [security](<https://devfeed.tech/tags/security.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>)

### AI overview

This tutorial explains how to protect npm packages from supply chain attacks. It covers Trusted Publishers, publishing restrictions, organization-wide 2FA, GitHub tag controls, pinned CI actions, CI security linting, cooldowns for new versions, and staged-release approval.

### Source excerpt

How to protect your npm package from being stolen in a supply chain attack and improve its position in security ratings

## Choose your fighter: benchmarking 5 WebSocket servers for Node.js

DevFeed: [Choose your fighter: benchmarking 5 WebSocket servers for Node.js](<https://devfeed.tech/articles/choose-your-fighter-benchmarking-5-websocket-servers-for-node-js-19781.md>)

Original publisher: [Read original article](<https://evilmartians.com/chronicles/choose-your-fighter-benchmarking-5-websocket-servers-for-nodejs>)

Author: Travis Turner (richardturner@evilmartians.com)

Published: 2026-06-24T00:00:00Z

Content type: comparison

Language: en

Sources: [Evil Martians](<https://devfeed.tech/sources/evil-martians.md>)

Topics: [WebSocket](<https://devfeed.tech/topics/websocket.md>), [Node.js](<https://devfeed.tech/topics/node-js.md>), [benchmarking](<https://devfeed.tech/topics/benchmarking.md>), [Socket.IO](<https://devfeed.tech/topics/socket-io.md>), [real-time](<https://devfeed.tech/topics/real-time.md>), [Latency](<https://devfeed.tech/topics/latency.md>)

Tags: [benchmark](<https://devfeed.tech/tags/benchmark.md>), [benchmarking](<https://devfeed.tech/tags/benchmarking.md>), [frontend-real-time](<https://devfeed.tech/tags/frontend-real-time.md>), [latency](<https://devfeed.tech/tags/latency.md>), [network](<https://devfeed.tech/tags/network.md>), [node](<https://devfeed.tech/tags/node.md>), [node-js](<https://devfeed.tech/tags/node-js.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [performance](<https://devfeed.tech/tags/performance.md>), [performance-scale](<https://devfeed.tech/tags/performance-scale.md>), [real-time](<https://devfeed.tech/tags/real-time.md>), [websocket](<https://devfeed.tech/tags/websocket.md>)

### AI overview

Evil Martians compare five WebSocket server options for Node.js: Socket.io, Socket.io with Connection State Recovery, uWebSockets.js, AnyCable OSS, and AnyCable Pro. The benchmark finds similar raw latency at 10,000 subscribers, while resilience under network drops, reconnect storms, and broadcast load separates the systems. AnyCable delivered all messages during simulated drops and led broadcast throughput; the other systems showed different recovery, connection-capacity, or message-loss trade-offs.

### Source excerpt

Evil Martians benchmarked five WebSocket servers for Node.js: Socket.io, uWebSockets.js, and AnyCable (OSS and Pro). How we caught our own load generator lying, and how to make WebSocket benchmark numbers honest.