
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
**CloudGrip** is the world’s first **AI-native observability platform**. It doesn’t just collect logs and metrics — it finds and fixes bugs in production **automatically**.
CloudGrip is the world’s first AI-native observability platform. It doesn’t just collect logs and metrics — it finds and fixes bugs in production automatically.
CloudGrip turns observability from passive data collection into an active DevOps agent — fixing issues before users even notice.
👉 Learn more at cloudgrip.ai
npm install cloudgrip
import { CloudGrip } from 'cloudgrip';
const cg = new CloudGrip({
apiKey: 'cg_123456789',
});
cg.logger.info('User login', { userId: 'abc123' });
cg.logger.error(new Error('Something went wrong'), 'Failed to process request');
cg.metrics.counter('http.requests');
cg.metrics.histogram('http.request.duration', 245);
cg.metrics.gauge('heap.usage.bytes', process.memoryUsage().heapUsed);
const spanId = cg.tracer.span('db_query', { traceId: 'abc123' });
// ... your code here ...
cg.tracer.endSpan(spanId);
import pino from 'pino';
const logger = pino({
transport: {
target: 'cloudgrip/transport',
options: {
apiKey: 'cg_123456789',
},
},
});
logger.info('This log is sent to CloudGrip');
| Method | Level | Description |
|---|---|---|
trace() | 10 | Most detailed logs — every step, for deep debugging |
debug() | 20 | Internal debugging info |
info() | 30 | Normal logs: service start, request handled, etc. |
warn() | 40 | Something unexpected, but not broken |
error() | 50 | An error occurred, but app continues to run |
fatal() | 60 | Unrecoverable error, likely before shutdown |
Pass the following options when creating the SDK instance:
const cg = new CloudGrip({
apiKey: 'cg_123456789',
host: 'https://telemetry-api.cloudgrip.ai', // optional
logLevel: 'info', // optional
logToConsole: true, // optional
maxBufferSize: 1000, // optional
flushIntervalMs: 5000, // optional
});
| Option | Type | Required | Description |
|---|---|---|---|
apiKey | string | ✅ Yes | Your CloudGrip API key |
host | string | No | Custom endpoint for telemetry export (defaults to CloudGrip API) |
logLevel | string | No | Minimum log level (trace, debug, etc.). Default: trace |
logToConsole | boolean | No | Whether to also print logs to stdout. Default: true in development |
maxBufferSize | number | No | Max telemetry items buffered before flushing |
flushIntervalMs | number | No | Time (ms) between automatic telemetry flushes |
The SDK automatically sets deployment.environment based on process.env.NODE_ENV.
If NODE_ENV is not set, it defaults to "development".
FAQs
**CloudGrip** is the world’s first **AI-native observability platform**. It doesn’t just collect logs and metrics — it finds and fixes bugs in production **automatically**.
We found that cloudgrip demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.