Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
awesome-error-handler
Advanced tools
Awesome error handler that makes your development experience with express more awesome
Accelerate your development.
Stacktraces may be very long and noisy. Console output can also be too noisy.
Express default error handling is just ok but lets you define you own error handlers](https://expressjs.com/en/guide/error-handling.html)
The npm module errorhandler improves it but does not fix it.
This module will make express error handling awesome.
Click on the video for a 2:30 minutes demo:
Awesome Error Handler wants to give engineers a faster and better development experience and be still usable in production.
const awesomeErrorHandler = require('awesome-error-handler');
const app = express();
// Initialize some middleware helpers
awesomeErrorHandler.initialize({ app });
///
/// ... All your middlewares and routes go here ...
///
// The error route in express needs to be registered last so "next(error)" can handle the error
app.use(awesomeErrorHandler({ app }));
During development it aims to dramatically speedup the development process using a browser and Visual Studio Code. I wanted to keep it useful on the server side too but it needs work to make it generic enough.
Currently a lot of node modules still use asynchronous primitive with callbacks.
Unfortunately there is no simple way to intercept those error.
The standard try...catch
cannot catch these errors.
// Simple example
try {
setTimeout(() => throw new Error('Catch me if you can'), 0); // This will crash your server!
} catch (err) {
// This will NOT execute!
console.error('Error:', err);
}
In a better future when all modules will use async/await
and the Promise
API, error handling in Javascript will be a lot simpler. But at the moment this is the status quo.
cluster
and gracefully shut down the worker and start a new one so memory is cleaned unless you do proper clean up.It is doing some magic and wrap all node asynchronous Node APIs so it can catch those errors. I thought it was crazy but I learned to appreciate its monkey patching that save a lot of time in development. In these days the async_hooks
would be used.
Another similar npm module you may be familiar with that does something similar is longjohn.
When you have an an unhandled error in a route, you will see a page with the detail about the HTTP error, stack trace and other data in the request.
You can navigate the stack trace with the keyboard.
Click on the stacktrace in terminal (integetion with iTerm2 on Mac) or double clicking on the editor in the browser will teleport you in the same spot in Visual Studio Code.
In production we want to avoid to return to the client (usually the browser) stack traces or other sensitive information. The default behavior is not to show the detailed error to the user but track everything in the logs.
An error will show and a CURL request that can easily be used from command line to replicate the call.
Awesome Error Handler try to use good defaults but giving the flexibility necessary for most use cases and customization. For example , you may want to use your own logger that use your own format.
I keep these here for me and whoever need reference about tools that make stack traces easier to use.
Promise stack trace
--async-stack-traces
in Feb 2019https://github.com/AndreasMadsen/trace - Very promising replacement but without async try...catch support
async_hooks
(node -v > 8.9
)
Other npm
modules
What I really care about:
FAQs
Awesome error handler that makes your development experience with express more awesome
The npm package awesome-error-handler receives a total of 1 weekly downloads. As such, awesome-error-handler popularity was classified as not popular.
We found that awesome-error-handler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.