Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@ledgerhq/logs
Advanced tools
@ledgerhq/logs is an npm package designed to facilitate logging within applications that interact with Ledger hardware wallets. It provides a simple and consistent way to log messages, which can be useful for debugging and monitoring the behavior of applications.
Basic Logging
This feature allows you to log messages with a specific type and level. In this example, 'apdu' is the type, 'message' is the content, and 'debug' is the level of the log.
const { log } = require('@ledgerhq/logs');
log('apdu', 'message', 'debug');
Custom Log Listener
You can set up a custom listener to handle log messages. This example demonstrates how to listen for log events and print them to the console.
const { listen } = require('@ledgerhq/logs');
listen(log => {
console.log(log.type, log.message, log.level);
});
Winston is a versatile logging library for Node.js that supports multiple transports (e.g., console, file, HTTP). It is more feature-rich compared to @ledgerhq/logs, offering advanced features like log levels, custom formats, and more.
Bunyan is another logging library for Node.js that focuses on JSON output for structured logging. It provides features like log levels, serializers, and streams. Bunyan is more suitable for applications that require structured logs and advanced logging capabilities.
Pino is a fast and low-overhead logging library for Node.js. It is designed for high-performance logging and provides features like log levels, serializers, and transports. Pino is ideal for applications that need efficient and performant logging.
Utility library that is used by all Ledger libraries to dispatch logs so we can deal with them in a unified way.
A Log object
A namespaced identifier of the log (not a level like "debug", "error" but more like "apdu", "hw", etc...)
Type: LogType
Data associated to the log event
Type: LogData
Context data, coming for example from the caller's parent, to enable a simple tracing system
Type: TraceContext
Unique id among all logs
Type: string
Logs something
type
LogType a namespaced identifier of the log (it is not a level like "debug", "error" but more like "apdu-in", "apdu-out", etc...)message
string? a clear message of the log associated to the typedata
LogData? A simple tracer function, only expanding the existing log function
Its goal is to capture more context than a log function. This is simple for now, but can be improved later.
context
{type: LogType, message: string?, data: LogData?, context: TraceContext?} Anything representing the context where the log occurred
context.type
context.message
context.data
context.context
A simple tracer class, that can be used to avoid repetition when using the trace
function
Its goal is to capture more context than a log function. This is simple for now, but can be improved later.
type
A given type (not level) for the current local tracer ("hw", "withDevice", etc.)context
Anything representing the context where the log occurredCreate a new instance of the LocalTracer with an updated type
It does not mutate the calling instance, but returns a new LocalTracer, following a simple builder pattern.
type
LogType Returns LocalTracer
Create a new instance of the LocalTracer with a new context
It does not mutate the calling instance, but returns a new LocalTracer, following a simple builder pattern.
context
TraceContext? A TraceContext, that can undefined to reset the contextReturns LocalTracer
Create a new instance of the LocalTracer with an updated context
,
on which an additional context is merged with the existing one.
It does not mutate the calling instance, but returns a new LocalTracer, following a simple builder pattern.
contextToAdd
TraceContext Returns LocalTracer
Adds a subscribers to the emitted logs.
cb
Subscriber that is called for each future log() with the Log objectReturns Unsubscribe a function that can be called to unsubscribe the listener
FAQs
Ledger logs central point
We found that @ledgerhq/logs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 21 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.