
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
Extensible error library.
##Installation
$ npm install cf-errors
##Creating an error
var CFError = require('cf-errors');
var error = new CFError("error message");
###Extending the error
var error = new CFError({field: "value", message: `error message`});
###Setting the error name
var error = new CFError({name: "ErrorType", message: "my error name"});
###Passing multiple objects will extend the previous objects
var error = new CFError({field: "value", message: `error message`}, {field2: "value"}, {field: "override first value"});
###Last argument passed to the constructor can be a string, which will populate the message field automatically
var error = new CFError({field: "value", message: `error message`}, {field2: "value"}, "my error message");
##Extending with a previous error
var extendedError = new CFError({
message: `extended error message`,
cause: error
});
##Printing the stack will print the stack of all previous errors too
console.log(extendedError.stack);
##toString()
Will print the whole chain of errors in a nice way.
You can always override it if you want.
CFError.prototype.toString = function(){
//your implementation
}
##Predefined Error Types
var CFError = require('cf-errors');
var Errors = CFError.Errors;
All predefined errors are exposed on 'CFError.Errors' object.
They are actually just simple objects so using the extension capability allows us to use them easily and extend them when needed.
####Http Errors
All http errors are available.
They will contain a field name 'statusCode' for your use.
var error = new CFError(Errors.Http.BadRequest, {
message: `failed to validate your request`
});
If you are using express.js then your error middleware can look something like this:
app.use(function(err, request, response, next){
console.error(err.stack);
var statusCode = 400;
if (err.constructor && err.constructor.name === "CFError") {
statusCode = err.statusCode || statusCode;
}
return response.status(statusCode).send(err.message);
});
####Node Errors All node.js core errors are also available using the Errors.Node object.
##Inheriting the previous error type Creating an error with the same name as its cause can be achieved using 'Inherit' as the error name.
var extendedError = new CFError(Errors.Inherit, {
message: `extended error message`,
cause: error
});
This will also work
var extendedError = new CFError({
name: "Inherit",
message: `extended error message`,
cause: error
});
##Getting the value of the first occurrence of a field in the chain
Sometimes you will populate an error with a field and wrap it with an additional error. In order to get the value of the field you will need to recursively go over the whole chain.
In order to get the first value of a field in the chain use 'getFirstValue' function.
var error = new CFError({field: "value", field1: "firstValue"});
var extendedError = new CFError({cause: error, field1: "newValue"});
extendedError.getFirstValue('field') // "value"
extendedError.getFirstValue('field1') // "newValue"
extendedError.getFirstValue('field2') // undefined
##Running the tests 'npm test' or 'gulp unit_test'
FAQs
Extensible error library
We found that cf-errors demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.