
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@redwoodjs/telemetry
Advanced tools
RedwoodJS collects completely anonymous telemetry data about general usage.
Here is an example JSON packet containing the telemetry data for running yarn rw info:
{
"type": "command",
"command": "info", // actual CLI command that was invoked, including flags
"ci": false, // whether or not this is running in a CI environment
"duration": 2353, // how long the process took, in milliseconds
"NODE_ENV": "development", // the value of NODE_ENV, if set
"complexity": "4.2.6.3", // a measure of how complex the app is (route, service, cell and page counts)
"system": "8.32", // cpu core count, memory in GB
"sides": "web,api", // sides that are in use
"shell": "zsh",
"nodeVersion": "14.17.1",
"yarnVersion": "14.17.1",
"npmVersion": "14.17.1",
"vsCodeVersion": "1.58.0",
"redwoodVersion": "0.35.1",
"os": "macOS",
"osVersion": "11.4",
"system": "8.32" // number of cpu cores and system memory
}
Set an environment variable, either in your app's .env file, or anywhere that creates variables for your user space, like .bashrc or .bash_profile:
REDWOOD_DISABLE_TELEMETRY=1
See: https://telemetry.redwoodjs.com
If you suspect problems with telemetry when running CRWA, you can set the verbose flag to help diagnose issues.
For example,
REDWOOD_VERBOSE_TELEMETRY=true yarn create-redwood-app bazinga
FAQs
Unknown package
The npm package @redwoodjs/telemetry receives a total of 14,087 weekly downloads. As such, @redwoodjs/telemetry popularity was classified as popular.
We found that @redwoodjs/telemetry demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.