
Research
6 Malicious Packagist Themes Ship Trojanized jQuery and FUNNULL Redirect Payloads
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.
@studio/log
Advanced tools
👻 Log ndjson to an output stream, pretty print the output with emoji ✨

Note! Version 2 has significantly changed compared to the original announcement. Make sure to read the release notes for migration instructions!
Log output is disabled by default to ensure logs don't get in the way when writing unit tests. Therefore you want to set this up as the first thing in your main:
// Sending raw ndJSON logs to stdout, e.g. in a server application:
const Stringify = require('@studio/ndjson/stringify');
require('@studio/log')
.pipe(new Stringify())
.pipe(process.stdout);
// Sending fancy formatted logs to stdout, e.g. in a command line tool:
const Format = require('@studio/log-format/fancy');
require('@studio/log')
.pipe(new Format())
.pipe(process.stdout);
// Sending logs to console.log, e.g. in a browser:
const Format = require('@studio/log-format/console');
require('@studio/log')
.pipe(new Format())
Next, create a logger instance in a module and start writing logs:
const logger = require('@studio/log');
const log = logger('app');
exports.startService = function (port) {
log.launch('my service', { port: 433 });
};
In the server example above, this output is produced:
{"ts":1486630378584,"ns":"app","topic":"launch","msg":"my service","data":{"port":433}}
Send your logs to the emojilog CLI for pretty printing:
❯ cat logs.ndjson | emojilog
09:52:58 🚀 app my service port=433
❯ npm i @studio/log
Instead of log levels, this logger uses a set of topics. Unlike log levels, topics are not ordered by severity.
These topics are available: ok, warn, error, issue, ignore, input,
output, send, receive, fetch, finish, launch, terminate, spawn,
broadcast, disk, timing, money, numbers and wtf.
Topics and their mapping to emojis are defined in the Studio Log Topics project.
ns: The logger instance namespace.ts: The timestamp as returned by Date.now().topic: The topic name.msg: The message.data: The data.stack: The stack of error object.cause: The cause stack of error.cause object, if available.log = logger(ns[, data]): Creates a new logger with the given namespace.
The namespace is added to each log entry as the ns property. If data is
provided, it is added to each log entry. Multiple calls with the same ns
property return the same logger instance while data is replaced.log.child(ns[, data]): Creates a child logger of a log instance. The
namespaces are joined with a blank and data is merged. Multiple calls with
the same ns property return the same logger instance while data is
replaced.log.{topic}([message][, data][, error]): Create a new log entry with these
behaviors:
topic is added as the "topic".message is present, it's added as the "msg".data is present, it's added as the "data".error is present, the stack property of the error is added as the
"stack". If no stack is present, the toString representation of the
error is used.error.code is present, it is added to the "data" without modifying
the original object.error.cause is present, the stack property of the cause is added
as the "cause". If no stack is present, the toString representation
of the cause is used.error.cause.code is present, a cause object is added to the
"data" with { code: cause.code } and without modifying the original
object.logger.pipe(stream): Configure the output stream to write logs to. If not
specified, no logs are written. Returns the stream.logger.hasStream(): Whether a stream was set.logger.reset(): Resets the internal state.Transform streams can be used to alter the data before passing it on. For
example, Studio Log X is a Transform stream that can remove confidential
data from the log data and Studio Log Format project implements the
basic, fancy and console pretty printers.
Format transforms are node transform streams in writableObjectMode. Here
is an example implementation, similar to the ndjson stringify transform:
const { Transform } = require('stream');
const ndjson = new Transform({
writableObjectMode: true,
transform(entry, enc, callback) {
const str = JSON.stringify(entry);
callback(null, `${str}\n`);
}
});
MIT
FAQs
A tiny streaming ndJSON logger
The npm package @studio/log receives a total of 935 weekly downloads. As such, @studio/log popularity was classified as not popular.
We found that @studio/log demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Six malicious Packagist packages posing as OphimCMS themes contain trojanized jQuery that exfiltrates URLs, injects ads, and loads FUNNULL-linked redirects.

Security News
The GCVE initiative operated by CIRCL has officially opened its publishing ecosystem, letting organizations issue and share vulnerability identifiers without routing through a central authority.

Security News
The project is retiring its odd/even release model in favor of a simpler annual cadence where every major version becomes LTS.