
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@worknice/instrumentation
Advanced tools
Shared instrumentation and correlation ID management for Worknice applications.
This package is part of the Worknice monorepo and is automatically available to all apps:
pnpm add @worknice/instrumentation
For Next.js apps, create an instrumentation.ts file in the app root:
// apps/$app-name/instrumentation.ts
export { register, onRequestError } from "@worknice/instrumentation";
register() - Initialises instrumentation. Automatically called by Next.js when instrumentation is enabled.onRequestError() - Handles and logs request errors with correlation tracking. Automatically called by Next.js on errors.The package provides multiple ways to work with correlation IDs:
import { getCorrelationId } from "@worknice/instrumentation";
const correlationId = getCorrelationId();
import { runWithCorrelationId, getCorrelationId } from "@worknice/instrumentation";
await runWithCorrelationId("$correlationId", async () => {
// All async operations here will have access to the correlation ID
const id = getCorrelationId(); // Returns "$correlationId"
});
import { getOrGenerateCorrelationId } from "@worknice/instrumentation";
const { correlationId, isNew } = getOrGenerateCorrelationId();
Extract correlation ID from HTTP headers in order:
x-request-idx-correlation-idrequest-idcorrelation-idimport { extractCorrelationIdFromHeaders } from "@worknice/instrumentation";
const correlationId = extractCorrelationIdFromHeaders(request.headers);
The package supports the following environment variables:
AXIOM_DATASET: Axiom dataset name for error loggingAXIOM_TOKEN: Axiom API token for authenticationNODE_ENV: Environment name (development, staging, production)When Axiom credentials are not provided, the package falls back to console logging.
The package uses Node.js AsyncLocalStorage to maintain correlation context across async boundaries without explicitly passing IDs through function calls. This allows correlation IDs to automatically flow through:
pnpm --filter=@worknice/instrumentation build
pnpm --filter=@worknice/instrumentation dev
pnpm --filter=@worknice/instrumentation test:lint
pnpm --filter=@worknice/instrumentation test:types
pnpm --filter=@worknice/instrumentation test:format
When a request flows through multiple services (e.g., Notebook → MYOB → External API), the correlation ID helps trace the entire request chain:
In Notebook app:
import { getOrGenerateCorrelationId } from "@worknice/instrumentation";
const { correlationId } = getOrGenerateCorrelationId();
await fetch("https://myob-service/api/endpoint", {
headers: {
"x-correlation-id": correlationId,
},
});
In MYOB service:
import { extractCorrelationIdFromHeaders, runWithCorrelationId } from "@worknice/instrumentation";
const correlationId = extractCorrelationIdFromHeaders(req.headers);
runWithCorrelationId(correlationId, async () => {
// All operations here share the same correlation ID
await processRequest();
});
Track background jobs initiated from web requests:
In API route:
import { getCorrelationId } from "@worknice/instrumentation";
const correlationId = getCorrelationId();
await inngest.send({
name: "process.data",
data: { correlationId, ...payload },
});
In Inngest function:
import { runWithCorrelationId } from "@worknice/instrumentation";
export const processData = inngest.createFunction(
{ id: "process-data" },
{ event: "process.data" },
async ({ event }) => {
return runWithCorrelationId(event.data.correlationId, async () => {
// Job execution with correlation tracking
});
}
);
If getCorrelationId() returns undefined:
runWithCorrelationId)setTimeout without binding)AXIOM_DATASET and AXIOM_TOKEN environment variables are setFAQs
Shared instrumentation management for Worknice applications
We found that @worknice/instrumentation demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.