Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
var logger = require('bi-logger');
logger.reinitialize
method.porcess.cwd() + '/logs'
dirrectory (=default behavior).Example 1
{
exitOnError: false, // determines whether a process will exit with status code 1 on 'uncaughtException' event
transports: [
{
type: 'fluentd', // [required]
priority: 1, // [default=Infinity] [required]
origin: 'bi-depot', // [required]
host: '127.0.0.1', // [required]
port: 24224, // [required]
timeout: 3, // [optional]
reconnectInterval: 60000 //ms [optional]
},
{
type: 'file',
level: 'error', // maximum log level of this sepecific transport, [optional]
priority: 2,
dir: 'logs', // can be absolute or relative to the node's process
autocreate: true // whether the `dir` should be created if it does not exist
},
{
type: 'console',
level: 'uncaughtException',
priority: 3
}
]
}
fluentd
server.fluentd
logger is experienced, reason behind the failure is logged into the ./logs/fault-${date}.json
file.fluentd
transports continues to buffer its logs and tries to reconnect to the fluentd server.type
- fluentd | file | consolepriority
- Highest=1
Lowest=Infinity
level
- maximum log level of this a transport
uncaughtException
| error
| warn
| info
| verbose
logger.error()
& logger.info
etc..level
option value equals eg. error
- only uncaughException
& error
events will be logged. Other event will be ignoredvar logger = require('bi-logger');
//if needed, reinitialize should be called once at app's initialization cycle
//every time `reinitialize` is called, static `bi-logger` module is reconfigured
logger.reinitialize({
transports: [
type: 'file',
dir: 'logs',
autocreate: true
]
});
//somewhere in the app:
var err = new Error('test');
logger.error(err);
logger.error('message', {meta: 'data'});
logger.warn('message', {meta: 'data'});
logger.info('message', {meta: 'data'});
For far, we discussed only logging of "fault" events in application's life cycle.
In case you need to log other types of data, eg. OAuth events, you want to create a new logger:
//create a new logger
var oauthLogger = logger.getOrBuildLogger('oauth', {
levels: {
authFailure: 0
refreshAccess: 1,
}
});
//use logger
oauthLogger.authFailure({
accountId: 'id',
ip: req.ip,
origin: req.header('origin')
});
FAQs
wrapper around winston logger
The npm package bi-logger receives a total of 1 weekly downloads. As such, bi-logger popularity was classified as not popular.
We found that bi-logger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.