Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@timberio/core
Advanced tools
New to Timber? Here's a low-down on logging in Javascript.
@timberio/core
This is an NPM package that provides core logging functionality.
It's used by the Node and browser logging packages.
You typically wouldn't require this package directly, unless you're building a custom logger.
Base
classThe Base class provides core features that is extended by loggers.
For example - you could create a custom logger that implements its own sync method, for getting data over to Timber.io
import { Base } from "@timberio/core";
class CustomLogger extends Base {
// Constructor must take a Timber.io API key
public constructor(apiKey: string) {
// Make sure you pass the API key to the parent constructor!
super(apiKey);
// Create a custom sync method
this.setSync(async (log: ITimberLog) => {
// Sync the `log` somehow ... `this._apiKey` contains your Timber API key
// ....
// Finally, return the log... which will resolve our initial `.log()` call
return log;
});
}
}
Logging to Timber is simple - just call the .log()
function.
timber.log({ message: "Hello Timber!", date: new Date() });
The .log()
method returns a Promise, which resolves when the log has been synced with Timber.io
You can add your own 'pipeline' middlware functions, which act as transforms on the passed log: ITimberLog
. This is useful for adding your own logging middleware, or augmenting the log prior to syncing with Timber.
For example, there's an implicit preProcess
pipeline that adds an explicit date timestamp to a log that lacks one:
async function preProcess(log: ITimberLog): Promise<ITimberLog> {
return {
date: new Date(),
...log
};
}
You can add any number of pipeline functions to your logger instance (which will run in order):
// Add a custom pipeline function - aka middleware
timber.use(preProcess);
Pipelines run before the final sync to Timber.io. Pipeline functions should return a Promise<ITimberLog>
, making it possible to augment logs, send to another destination, throw errors, etc.
Note: If an exception is thrown anywhere in the pipeline chain, the log won't be synced. Wrap an async try/catch
block around your call to .log()
or tack on a .catch()
to ensure your errors are handled.
More docs TBA
FAQs
Timber.io - logging core
We found that @timberio/core demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.