Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@eropple/nestjs-bunyan
Advanced tools
Module and tooling for request-scoped Bunyan logging in NestJS.
@eropple/nestjs-bunyan
This package contains a module to provide Bunyan logging across a NestJS application. It supports full request-specific logging by providing a request-scoped Bunyan logger in the dependency injector and includes an in/out interceptor for recording request data and request timing.
staticLogger
option. When true, the LOGGER
key (and the
@Logger()
decoration) injects the same thing as ROOT_LOGGER
, making
it easier to use NestJS logging outside of an HTTP context.yarn add @eropple/nestjs-bunyan
or npm install --save @eropple/nestjs-bunyan
depending on your package manager of choice.
@eropple/nestjs-bunyan
expects you to define a Bunyan logger somewhere in your
application--a global, a logger via ConfigService, whatever makes the most sense
for your application.
Import it at the root of your application:
import { Module } from '@nestjs/common';
import { LoggingModule } from "@eropple/nestjs-bunyan";
import { ROOT_LOGGER } from './logger';
import { AppController } from './app.controller';
import { AppService } from './app.service';
@Module({
imports: [
LoggingModule.forRoot(ROOT_LOGGER, {})
],
controllers: [AppController],
providers: [AppService],
})
export class AppModule {}
This will do a few things:
@RootLogger()
decorator on your constructor parameter. (You can use this
with Scope.DEFAULT
injected services.)@Logger()
decorator on your constructor parameter. You must only use this
with Scope.REQUEST
injected services (and NestJS should transitively make
anything that depends on @Logger()
a request-scoped provider automatically.)Important note: this module expects a request to have some kind of
correlation ID. By default, this will be X-Correlation-Id
(and if you need
to inject that, might I recommend @eropple/nestjs-correlation-id?), but you
can change it to, for example, X-Request-Id
, by passing something like
correlationIdHeader: "X-Request-Id"
to the options in
LoggingModule.forRoot()
.
@eropple/nestjs-bunyan
also includes a request tracking middleware that
records into the log the start and end of every request coming into your server.
The start log entry includes all request headers; the end log entry includes the
time taken with the request and the status code. You can use these, plus the
correlation ID, to determine overall request timings.
The implementation is currently a little tortured (to write, not to use), so it's implemented a little differently than normal. Use it a-like so:
async function bootstrap() {
const app = await NestFactory.create(AppModule);
app.use(CorrelationIdMiddleware());
LoggingModule.addRequestMiddleware(app);
await app.listen(3000);
}
bootstrap();
The request middleware records timing in milliseconds, so it probably doesn't matter too much where in your middleware chain you do it, but it's probably best to put it as early in the process as possible, immediately behind whatever middleware is ensuring that you have a working correlation ID.
import * as Bunyan from "bunyan";
import { Controller, Get, Scope } from '@nestjs/common';
import { Logger } from "@eropple/nestjs-bunyan";
import { AppService } from './app.service';
@Controller({ scope: Scope.REQUEST })
export class AppController {
private readonly _logger: Bunyan;
constructor(
@Logger() requestLogger: Bunyan,
private readonly appService: AppService
) {
this._logger = requestLogger.child({ component: this.constructor.name });
}
@Get()
getHello(): Promise<string> {
return new Promise((resolve, reject) => {
this._logger.info("getHello hit; pausing.");
setTimeout(() => {
this._logger.info('getHello done!');
resolve(this.appService.getHello());
}, 1000)
})
}
}
And some sample output, when passed through the bunyan
executable:
[2019-05-29T01:58:11.789Z] INFO: example-app/RequestTracker/27937 on bigboss: (correlationId=7f8901a5-8706-4059-875a-fb69a28a4213, request=start, method=GET, url=/, ip=::1)
headers: {
"host": "localhost:3000",
"user-agent": "curl/7.61.1",
"accept": "*/*",
"x-correlation-id": "7f8901a5-8706-4059-875a-fb69a28a4213"
}
[2019-05-29T01:58:11.796Z] INFO: example-app/AppController/27937 on bigboss: getHello hit; pausing. (correlationId=7f8901a5-8706-4059-875a-fb69a28a4213)
[2019-05-29T01:58:12.799Z] INFO: example-app/AppController/27937 on bigboss: getHello done! (correlationId=7f8901a5-8706-4059-875a-fb69a28a4213)
[2019-05-29T01:58:12.802Z] INFO: example-app/RequestTracker/27937 on bigboss: (correlationId=7f8901a5-8706-4059-875a-fb69a28a4213, request=end, code=200, ms=1013)
FAQs
Module and tooling for request-scoped Bunyan logging in NestJS.
The npm package @eropple/nestjs-bunyan receives a total of 103 weekly downloads. As such, @eropple/nestjs-bunyan popularity was classified as not popular.
We found that @eropple/nestjs-bunyan demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.