
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
A wrapper for switching logging libraries depending on environment.
Works like a drop in place replacement of Debug but uses Pino in production environment.
Debug-env:
NODE_ENV or DEBUGGER var npm install debug-env --save
You can use exactly like Debug. Once you want to separate messages by level just call by method.
Example:
const debug = require('debug-env')('namespace:namespace');
debug("Default behaviour"); // level debug
// Calling it with levels
debug.warn("You want to look at this at runtime");
debug.trace("SQL for something", sql); // You don't want to see this often
// Check available levels (Same as in Pino)
console.log(require('debug-env').levels);
['fatal', 'error', 'warn', 'info', 'debug', 'trace']
Works by reading the following environment variables:
DEBUG or NS: namespace (from Debug)*DEBUG_LEVEL: (default level: debug) (from Pino)DEBUGGER: Force overrides debugger to use* Many packages use Debug, if you activate DEBUG=* all packages will log directly. If you have that issue use NS instead.
Example:
DEBUG=myapp:* DEBUG_LEVEL=debug npm start
You can change nearly all configuration using force:
let debug = require('debug-env');
let options = {
loggers: {
production: 'pino',
development: 'debug',
test: 'debug'
},
level: 'warn',
env: 'development',
namespaces: 'test:msg'
};
debug.force(options);
process.env.DEBUG = 'test:msg'; // we don't override the real var in the package
debug = test('test:msg');
// Or force a debbuger from the command line
DEBUGGER=pino npm start
In production mode the logger is changed to Pino without you making any changes to the code.
Namespaces are added to the output as ns property. You can use Pino transports and other external libraries as usual.
Example Using pm2 to execute and control the log rotation. Check pm2 ecosystem file.
pm2 ecosystem.conf.js
module.exports = {
apps : [{
name : 'myapp',
script : 'node index.js',
env: {
NODE_ENV: 'development',
DEBUG:'boot:*',
DEBUG_LEVEL:'debug'
},
env_production : {
NODE_ENV: 'production',
DEBUG:'myapp:*',
DEBUG_LEVEL:'info'
}
}]
};
It is possible to use libraries specific functionality but it will break compatibility. So you need to do it conditionally.
if (process.env.NODE_ENV === 'production') {
// do stuff for PINO
} else {
// do stuff for DEBUG
}
Debug actually returns debug, and it's also available under the logger property.
// Example taken and adapted from Debug site
const createDebug = require('debug-env');
createDebug.logger.debug.formatters.h = (v) => {
return v.toString('hex');
}
const debug = createDebug('foo');
Pino receives parameters as an object when creating loggers. Pass this object as a second parameter after namespace and it will be directly passed to pino.
// Example from pino-noir
var pino = require('pino')({
serializers: redaction
});
// To do the same with debug-env:
const pinoOptions = {
serializers: redaction
};
const createDebug = require('debug-env')(namespace, pinoOptions));
Both libraries are far more powerful. If you require advance functionality, you can add conditionally or use the library directly.
FAQs
Debugger for NodeJS, switches between debug/pino depending on environment.
The npm package debug-env receives a total of 1 weekly downloads. As such, debug-env popularity was classified as not popular.
We found that debug-env demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.