
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@platformatic/promotel
Advanced tools
promotel: Prometheus to OpenTelemetry conversion library for JavaScript/TypeScript
A pure TypeScript implementation for converting Prometheus metrics to OpenTelemetry Protocol (OTLP) format. Promotel provides fast, reliable conversion between Prometheus and OTLP formats with full type safety and comprehensive protobuf support.
npm install @platformatic/promotel
Requirements: Node.js 18+
The easiest way to get started is with the CLI server for automated conversion:
npx @platformatic/promotel \
--prometheus-url http://my-app:9090/metrics \
--otlp-url http://otel-collector:4318/v1/metrics \
--interval 30000 \
--service-name my-service \
--service-version 1.0.0
This will automatically fetch metrics from your Prometheus endpoint every 30 seconds and push them to your OpenTelemetry collector.
For Node.js applications using prom-client, use the automated bridge:
import { PromClientBridge } from '@platformatic/promotel';
import { register } from 'prom-client';
const bridge = new PromClientBridge({
registry: register, // Your prom-client registry
otlpEndpoint: 'http://otel-collector:4318/v1/metrics',
interval: 15000, // 15 seconds
conversionOptions: {
serviceName: 'my-app',
serviceVersion: '1.2.3'
}
});
bridge.start(); // Begins automatic metric collection and pushing
For fetching from external Prometheus endpoints:
import { gather, dispatch, convert } from '@platformatic/promotel';
// Gather from Prometheus endpoint
const writeRequest = await gather({
url: 'http://app:9090/metrics'
});
// Convert to OTLP
const otlpData = convert(writeRequest);
// Dispatch to OTLP endpoint
await dispatch(otlpData, {
url: 'http://otel-collector:4318/v1/metrics'
});
parse(text: string): prometheus.IWriteRequestParses Prometheus text exposition format into protobuf WriteRequest.
const writeRequest = parse(`
# HELP cpu_usage CPU usage percentage
# TYPE cpu_usage gauge
cpu_usage{cpu="0"} 45.2
cpu_usage{cpu="1"} 38.7
`);
convert(writeRequest, options?): opentelemetry.proto.collector.metrics.v1.IExportMetricsServiceRequestConverts Prometheus WriteRequest to OTLP format.
Parameters:
writeRequest: Prometheus protobuf WriteRequestoptions: Conversion options (optional)
serviceName?: string - Service name (default: 'promotel-js')serviceVersion?: string - Service version (default: '0.1.0')defaultTimestamp?: number - Default timestamp in millisecondsconst otlpData = convert(writeRequest, {
serviceName: 'payment-service',
serviceVersion: '2.1.0',
defaultTimestamp: Date.now()
});
encode(data): Uint8ArrayEncodes OTLP ExportMetricsServiceRequest to protobuf bytes.
const bytes = encode(otlpData);
// Send bytes over HTTP, gRPC, etc.
gather(options): Promise<prometheus.IWriteRequest>Fetches metrics from a Prometheus HTTP endpoint with content negotiation.
Options:
url: string - Prometheus metrics endpoint URLheaders?: Record<string, string> - Additional HTTP headerssignal?: AbortSignal - Abort signal for request cancellationconst writeRequest = await gather({
url: 'https://my-app.com/metrics',
headers: { 'Authorization': 'Bearer token123' },
signal: AbortSignal.timeout(5000)
});
dispatch(data, options): Promise<void>Pushes OTLP data to an OpenTelemetry collector endpoint.
Options:
url: string - OTLP metrics endpoint URLheaders?: Record<string, string> - Additional HTTP headerssignal?: AbortSignal - Abort signal for request cancellationawait dispatch(otlpData, {
url: 'http://jaeger:14268/api/traces',
headers: { 'Content-Encoding': 'gzip' }
});
getFromRegistry(options?): Promise<prometheus.IWriteRequest>Extracts metrics from a prom-client registry as protobuf WriteRequest.
Options:
registry?: Registry - Prom-client registry (defaults to default registry)import { register, Counter } from 'prom-client';
const counter = new Counter({
name: 'my_counter',
help: 'Example counter',
registers: [register]
});
const writeRequest = await getFromRegistry({ registry: register });
PromClientBridgeAutomated bridge that periodically converts metrics from a prom-client registry and pushes to an OTLP endpoint.
Constructor Options:
registry: Registry - Prom-client registryotlpEndpoint: string | OTLPEndpointOptions - OTLP endpoint configurationinterval?: number - Collection interval in milliseconds (default: 60000)conversionOptions?: ConversionOptions - OTLP conversion optionsonError?: (error: Error) => void - Error handlerMethods:
start(): void - Start periodic collectionstop(): void - Stop periodic collectioncollectAndPush(): Promise<void> - Manual collection triggerconst bridge = new PromClientBridge({
registry: myRegistry,
otlpEndpoint: {
url: 'http://collector:4318/v1/metrics',
headers: { 'x-api-key': 'secret' }
},
interval: 30000,
onError: (error) => console.error('Bridge error:', error)
});
bridge.start();
// Later...
bridge.stop();
MetricsPipelineFlexible pipeline for metrics collection, conversion, and delivery with pluggable data sources.
Constructor Options:
source: MetricsSource - Metrics data source implementationotlpEndpoint: string | OTLPEndpointOptions - OTLP endpoint configurationinterval?: number - Collection interval in milliseconds (default: 60000)conversionOptions?: ConversionOptions - OTLP conversion optionsonError?: (error: Error) => void - Error handlerCustom Source Example:
class DatabaseMetricsSource implements MetricsSource {
async fetch(): Promise<prometheus.IWriteRequest> {
const metrics = await this.queryDatabase();
return this.convertToPrometheus(metrics);
}
}
const pipeline = new MetricsPipeline({
source: new DatabaseMetricsSource(),
otlpEndpoint: 'http://collector:4318/v1/metrics'
});
The CLI provides a standalone server for automated metric conversion:
npx @platformatic/promotel \
--prometheus-url http://app:9090/metrics \
--otlp-url http://collector:4318/v1/metrics \
--interval 30000 \
--service-name my-service \
--service-version 1.0.0
Options:
--prometheus-url - Source Prometheus metrics endpoint--otlp-url - Destination OTLP endpoint--interval - Collection interval in milliseconds (default: 60000)--service-name - Service name for OTLP data (default: 'promotel-js')--service-version - Service version for OTLP data (default: '0.1.0')--prometheus-headers - JSON string of headers for Prometheus requests--otlp-headers - JSON string of headers for OTLP requestsPromotel exports generated protobuf types for direct usage:
import { prometheus, opentelemetry } from '@platformatic/promotel';
// Prometheus types
const writeRequest: prometheus.IWriteRequest = {
timeseries: [],
metadata: []
};
// OpenTelemetry types
const exportRequest: opentelemetry.proto.collector.metrics.v1.IExportMetricsServiceRequest = {
resource_metrics: []
};
import { PrometheusParseError, OTLPConversionError } from '@platformatic/promotel';
try {
parse('invalid metrics');
} catch (error) {
if (error instanceof PrometheusParseError) {
console.log(`Parse error at line ${error.lineNumber}: ${error.message}`);
}
}
try {
await dispatch(data, { url: 'invalid-url' });
} catch (error) {
if (error instanceof OTLPConversionError) {
console.log(`OTLP error: ${error.message}`);
}
}
For direct conversion of Prometheus data without the automated pipelines:
import { parse, convert, encode } from '@platformatic/promotel';
// Parse Prometheus text format
const prometheusText = `
# HELP http_requests_total Total HTTP requests
# TYPE http_requests_total counter
http_requests_total{method="GET",status="200"} 1027
`;
const writeRequest = parse(prometheusText);
const otlpData = convert(writeRequest, {
serviceName: 'my-service',
serviceVersion: '1.0.0'
});
// Encode as protobuf for transmission
const bytes = encode(otlpData);
import { prometheus, encodeWriteRequest, decodeWriteRequest } from '@platformatic/promotel';
// Create WriteRequest manually
const writeRequest: prometheus.IWriteRequest = {
timeseries: [{
labels: [{ name: 'job', value: 'api' }],
samples: [{ value: 42, timestamp: Date.now() }]
}],
metadata: [{
type: prometheus.MetricMetadata.MetricType.GAUGE,
metric_family_name: 'memory_usage',
help: 'Memory usage in bytes'
}]
};
// Serialize to bytes
const bytes = encodeWriteRequest(writeRequest);
// Parse from bytes
const decoded = decodeWriteRequest(bytes);
class CloudWatchSource implements MetricsSource {
async fetch(): Promise<prometheus.IWriteRequest> {
const metrics = await this.getCloudWatchMetrics();
return this.transformToPrometheus(metrics);
}
private async getCloudWatchMetrics() {
// Fetch from CloudWatch API
}
private transformToPrometheus(metrics: any[]): prometheus.IWriteRequest {
// Convert CloudWatch metrics to Prometheus format
}
}
const pipeline = new MetricsPipeline({
source: new CloudWatchSource(),
otlpEndpoint: process.env.OTLP_ENDPOINT!,
conversionOptions: {
serviceName: 'cloudwatch-bridge'
},
onError: (error) => {
console.error('Pipeline failed:', error);
// Send to monitoring system
}
});
npm install
npm run build
# Run all tests
npm test
# Run tests with test environment
npm run test:with-env
# Type checking
npm run typecheck
# Linting
npm run lint
# Fetch latest protobuf definitions
npm run fetch:protos
# Generate TypeScript types
npm run generate:types
git checkout -b feature/amazing-feature)npm run lint and npm run typecheckgit commit -m 'Add amazing feature')git push origin feature/amazing-feature)MIT © Platformatic Inc.
FAQs
Convert Prometheus metrics to OpenTelemetry (OTLP) format
We found that @platformatic/promotel demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 9 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.