
Research
/Security News
TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.
@opentelemetry/context-async-hooks
Advanced tools
OpenTelemetry AsyncLocalStorage-based Context Manager
This package provides a ContextManager implementation built on APIs from Node.js's [async_hooks][async-hooks-doc] module. If you're looking for a ContextManager to use in browser environments, consider opentelemetry-context-zone or opentelemetry-context-zone-peer-dep.
See the definition of the ContextManager interface and the problem it solves.
A ContextManager implementations is exported:
AsyncLocalStorageContextManager, based on AsyncLocalStorageAsyncLocalStorageContextManager supports the optional attach() method for imperative context management. It sets a context as active and returns a disposable Token. Disposing the token restores the previously active context.
What is an "execution unit"? In Node.js, this refers to the current asynchronous execution chain - the currently running code plus all async operations that will be spawned from it (Promises, callbacks, async/await, timers, etc.). When you attach() a context, it becomes active for this entire chain until the token is disposed.
import { AsyncLocalStorageContextManager } from '@opentelemetry/context-async-hooks';
import { ROOT_CONTEXT } from '@opentelemetry/api';
const contextManager = new AsyncLocalStorageContextManager();
contextManager.enable();
const myContext = ROOT_CONTEXT.setValue('key', 'value');
// Attach a context - it becomes active for the current async execution chain
const token = contextManager.attach(myContext);
console.log(contextManager.active()); // myContext
// Context propagates to async operations automatically
await someAsyncOperation();
console.log(contextManager.active()); // still myContext
// Restore the previous context by disposing the token
token.dispose();
console.log(contextManager.active()); // ROOT_CONTEXT
Important: You should ensure that every attach() call has a corresponding token.dispose() call to avoid context leaks. Use a try/finally block for safety:
const token = contextManager.attach(myContext);
try {
await doWork();
} finally {
token.dispose(); // Always restore
}
For most use cases, prefer using with() as it automatically handles context restoration.
Not restoring context properly can lead to catastrophic effects on your telemetry, even outside the bounds of your instrumentation library.
Context propagation is a big subject when talking about tracing in Node.js. If you want more information about it here are some resources:
Apache 2.0 - See LICENSE for more information.
The cls-hooked package provides a similar functionality to @opentelemetry/context-async-hooks by using the async_hooks module to create context-like namespaces that are preserved across asynchronous calls. It differs in its API and is not specifically tailored for OpenTelemetry or tracing but can be used for general context propagation purposes.
While not a separate npm package, Node.js' built-in async_hooks module is the underlying technology that both @opentelemetry/context-async-hooks and cls-hooked rely on for tracking asynchronous operations. It provides the primitives for creating hooks that monitor the lifecycle of asynchronous operations, which can be used directly for custom context propagation implementations.
FAQs
OpenTelemetry AsyncLocalStorage-based Context Manager
The npm package @opentelemetry/context-async-hooks receives a total of 26,379,612 weekly downloads. As such, @opentelemetry/context-async-hooks popularity was classified as popular.
We found that @opentelemetry/context-async-hooks demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 6 open source maintainers collaborating on the project.

Research
/Security News
Tensorlake npm SDK version 0.5.144 was compromised in a ChainDrop / Shai-Hulud attack, delivering credential-stealing malware.

Research
/Security News
Socket found 16 malicious Firefox extensions designed to steal crypto wallet recovery phrases and private keys using cloned Rabby and OKX interfaces.

Product
Socket now scans VS Code extensions, giving teams early detection of risky behaviors, hidden capabilities, and supply chain threats in developer tools.