
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
Log to the system's Syslog. Provides simple native bindings to <syslog.h> and syslog(3). Works on Node v0.10 up to v4.
Syslogh.js is a library for logging to your system's Syslog (RFC
3164) from within Node.js. It provides simple native bindings to
<syslog.h> and syslog(3). You're in luck, because
it does not come with any bells and whistles. Intentionally. KISS, right?
Works with Node v0.10, v0.11, v0.12 and of course v4 (stable).
Using it in production with Monday Calendar, so will be kept up to
date when new Node versions come out.
Install with: npm install syslogh
Using Syslogh.js is similar to using syslog(3) from C/C++.
First use openlog with your app name (up to 255 characters), options and the
facility:
var Syslogh = require("syslogh")
Syslogh.openlog("myapp", Syslogh.PID, Syslogh.LOCAL7)
Then, when logging, just pass in the severity and your
message.
Just like with regular syslog(3), you can use sprintf style
placeholders. Those internally use Node's built-in Util.format.
Syslogh.syslog(Syslogh.NOTICE, "Freeze-frame high-five.")
Syslogh.syslog(Syslogh.NOTICE, "Phone %d.", 5)
You can also call Syslogh.closelog to close things down, but I'm not sure why
you should bother. :-) Exiting your Node.js program will most likely shut
everything down, too.
The syslog(3) manpage also talks about setlogmask to filter
logs before they're sent. This isn't implemented. Not yet, at least.
Options to pass to openlog come from <syslog.h>.
| Option | Description |
|---|---|
| CONS | Log to the system console on error. |
| ODELAY | Delay open until syslog() is called. (Often default.) |
| PID | Log the process ID with each message. |
| NDELAY | Connect to syslog daemon immediately. |
| NOWAIT | Don't wait for child processes. |
Access them as constants. E.g. Syslogh.PID.
They form a bit mask, so to pass multiple of them to openlog, binary-OR them
together with the | operator:
Syslogh.openlog("myapp", Syslogh.PID | Syslogh.NDELAY, Syslogh.LOCAL7)
Facilities to pass to openlog come from <syslog.h> and (RFC
3164).
Some facilities might differ between systems. For your own app use, best stick
to LOCAL* facilities.
| Facility | Description |
|---|---|
| KERN | Kernel messages. |
| USER | User-level messages. |
| Mail system. | |
| DAEMON | System daemons. |
| AUTH | Security/authorization messages. |
| SYSLOG | Messages generated internally by syslogd. |
| LPR | Line printer subsystem. |
| NEWS | Network news subsystem. |
| UUCP | UUCP subsystem. |
| CRON | Clock daemon. |
| AUTHPRIV | Security/authorization messages. |
| LOCAL0 | Local use 0. |
| LOCAL1 | Local use 1. |
| LOCAL2 | Local use 2. |
| LOCAL3 | Local use 3. |
| LOCAL4 | Local use 4. |
| LOCAL5 | Local use 5. |
| LOCAL6 | Local use 6. |
| LOCAL7 | Local use 7. |
Access them as constants. E.g. Syslogh.LOCAL7.
Severities to pass to syslog come from <syslog.h> and (RFC
3164).
| Severity | Description |
|---|---|
| EMERG | System is unusable. |
| ALERT | Action must be taken immediately. |
| CRIT | Critical conditions. |
| ERR | Error conditions. |
| WARNING | Warning conditions. |
| NOTICE | Normal but significant. |
| INFO | Informational messages. |
| DEBUG | Debug-level messages. |
Access them as constants. E.g. Syslogh.NOTICE.
Syslogh.js is released under a Lesser GNU Affero General Public License, which in summary means:
For more convoluted language, see the LICENSE file.
Andri Möll typed this and the code.
Monday Calendar supported the engineering work.
If you find Syslogh.js needs improving, please don't hesitate to type to me now at andri@dot.ee or create an issue online.
FAQs
Log to the system's Syslog. Provides simple native bindings to <syslog.h> and syslog(3). Works on Node v0.10 up to v4.
We found that ac-syslogh demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.