
Security News
/Research
Fake Corepack Site Distributes Infostealer and Proxyware to Developers
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.
dev-log-monitor
Advanced tools
Lightweight local log diagnostics for NestJS, Express, and Node.js development with real-time UI, error tracing, and breadcrumbs
Your existing logger + console.log(), but finally usable.
Real-time web UI • Error tracing • Breadcrumbs • Data masking • Zero dependencies
npm install dev-log-monitor
// Add this ONE LINE at the top of your entry file
import 'dev-log-monitor/auto';
// That's it. Open http://localhost:3333
console.log('This will appear in the dev-log UI!');
Auto-disables in production (
NODE_ENV=production). Zero config needed.
| Problem | Solution |
|---|---|
| "Which console.log printed this?" | Source location tracking (file:line -> function()) |
| "What happened before the crash?" | Breadcrumbs - last 10 logs before any error |
| "I can't read these stack traces" | Parsed & highlighted - your code vs node_modules |
| "Logs are flying by too fast" | Real-time web UI with filtering, search, and export |
| "Sensitive data in logs" | Auto-masks passwords, tokens, cards, SSNs (72+ fields) |
| "Different loggers everywhere" | Works with console, Winston, Pino, Bunyan, or custom |
|
One-Line Integration Real-Time Web UI Source Location Breadcrumbs |
Sensitive Data Masking Timing & Metrics Parsed Stack Traces Alerts & Webhooks |
// main.ts
import 'dev-log-monitor/auto';
import { NestFactory } from '@nestjs/core';
import { devLogger, DevLogContextInterceptor } from 'dev-log-monitor';
import { AppModule } from './app.module';
async function bootstrap() {
const app = await NestFactory.create(AppModule, {
logger: devLogger.nest(),
});
app.useGlobalInterceptors(new DevLogContextInterceptor());
await app.listen(3000);
}
bootstrap();
Use in services:
import { Injectable } from '@nestjs/common';
import { devLogger } from 'dev-log-monitor';
@Injectable()
export class UserService {
private logger = devLogger.create('UserService');
async createUser(data: CreateUserDto) {
this.logger.info('Creating user', { email: data.email });
}
}
import 'dev-log-monitor/auto';
import express from 'express';
import { expressContextMiddleware } from 'dev-log-monitor';
const app = express();
app.use(expressContextMiddleware());
app.get('/api/users', (req, res) => {
console.log('Fetching users'); // Automatically captured!
res.json({ users: [] });
});
app.listen(3000);
import 'dev-log-monitor/auto';
import { wrapLogger } from 'dev-log-monitor';
// Winston
import winston from 'winston';
const winstonLogger = winston.createLogger({ level: 'info', transports: [new winston.transports.Console()] });
const logger = wrapLogger(winstonLogger, 'winston');
// Pino
import pino from 'pino';
const pinoLogger = wrapLogger(pino(), 'pino');
// Bunyan
import bunyan from 'bunyan';
const bunyanLogger = wrapLogger(bunyan.createLogger({ name: 'myapp' }), 'bunyan');
import 'dev-log-monitor/auto';
// All console calls are now captured
console.log('Application started');
console.warn('Cache miss', { key: 'user:123' });
console.error('Database connection failed');
// Or use the devLogger directly
import { devLogger } from 'dev-log-monitor';
devLogger.info('Direct log', { data: 'value' });
All config via environment variables - no config files needed:
| Variable | Default | Description |
|---|---|---|
DEV_LOG_PORT | 3333 | Web UI port |
DEV_LOG_DIR | .dev-log | Log storage directory |
DEV_LOG_RETENTION | 3 | Days to keep logs |
DEV_LOG_CONSOLE | true | Also print to console |
DEV_LOG_INTERCEPT | true | Intercept console.log calls |
DEV_LOG_MASKING | true | Auto-mask sensitive data |
DEV_LOG_STORAGE_LEVEL | debug | Minimum level to persist |
DEV_LOG_DISABLE | false | Disable entirely |
Or configure programmatically:
import { autoInit } from 'dev-log-monitor';
await autoInit({
port: 3333,
logDir: '.dev-log',
retentionDays: 3,
consoleOutput: true,
interceptConsole: true,
storageLevel: 'debug',
maxFileSize: 50 * 1024 * 1024,
maxTotalSize: 100 * 1024 * 1024,
});
Open http://localhost:3333 after adding the import.
Keyboard Shortcuts:
| Key | Action | Key | Action |
|---|---|---|---|
/ | Focus search | t | Toggle theme |
j/k | Next/prev log | m | Toggle metrics |
Enter | Expand/collapse | e | Export logs |
1-4 | Filter by level | c | Clear logs |
? | Show shortcuts | Esc | Close/clear |
Error details show source location, breadcrumbs (last 10 logs before the error), and parsed stack traces with your app code highlighted.
import { asyncContext, getTraceId } from 'dev-log-monitor';
asyncContext.run(() => {
console.log('Start processing'); // auto-assigned traceId
someAsyncOperation().then(() => {
console.log('Done processing'); // same traceId
});
}, { method: 'GET', path: '/api/users' });
import { addAlertRule, addWebhook } from 'dev-log-monitor';
addWebhook('slack', { url: 'https://hooks.slack.com/services/xxx', method: 'POST' });
addAlertRule({
id: 'high-error-rate',
name: 'High Error Rate',
condition: { type: 'error_rate', threshold: 5 },
handlers: ['webhook:slack', 'console'],
cooldownMs: 60_000,
});
import { configureMasking } from 'dev-log-monitor';
configureMasking({
enabled: true,
sensitiveKeys: ['myCustomSecret'],
customPatterns: [
{ name: 'order-id', pattern: /ORDER-\d{6,}/g, replacement: 'ORDER-[REDACTED]' },
],
fullMask: false,
maskChar: '*',
});
Built-in:
password,token,apiKey,authorization,ssn,creditCard,cvv,pin, and 50+ more.
| Export | Description |
|---|---|
import 'dev-log-monitor/auto' | One-line auto-integration |
autoInit(config) | Configure and initialize manually |
configureMasking(options) | Configure sensitive data masking |
wrapLogger(logger, type?) | Wrap existing logger |
asyncContext | Request context manager |
getTraceId() | Get current trace ID |
getRequestId() | Get current request ID |
expressContextMiddleware() | Express middleware for context |
DevLogContextInterceptor | NestJS interceptor for context |
| Export | Description |
|---|---|
addAlertRule(rule) | Add custom alert rule |
addWebhook(name, config) | Add named webhook endpoint |
configureAlerts(config) | Configure alerts with rules and webhooks |
| Export | Description |
|---|---|
getMetrics() | Get current metrics snapshot |
onMetricsUpdate(callback) | Subscribe to metrics updates (returns unsubscribe fn) |
| Method | Description |
|---|---|
devLogger.init(config?) | Initialize manually (not needed with /auto) |
devLogger.debug(message, metadata?) | Log debug message |
devLogger.info(message, metadata?) | Log info message |
devLogger.warn(message, metadata?) | Log warning message |
devLogger.error(message, metadata?) | Log error message |
devLogger.create(context, source?) | Create scoped logger |
devLogger.nest() | Get NestJS adapter |
devLogger.express() | Get Express middleware |
devLogger.shutdown() | Gracefully shutdown |
| Method | Description |
|---|---|
logger.debug(message, metadata?) | Log debug with context |
logger.info(message, metadata?) | Log info with context |
logger.warn(message, metadata?) | Log warning with context |
logger.error(message, metadata?) | Log error with context |
logger.startTimer(operation) | Start operation timer |
npx dev-log-monitor clear # Clear all logs
npx dev-log-monitor status # Show storage status
npx dev-log-monitor help # Help
Logs are stored in .dev-log/ in JSONL format, named by date (logs-YYYY-MM-DD.jsonl).
Add to .gitignore:
.dev-log/
@nestjs/common >= 9.0.0, express >= 4.0.0MIT
Contributions are welcome! Please open an issue or submit a pull request at GitHub.
FAQs
Lightweight local log diagnostics for NestJS, Express, and Node.js development with real-time UI, error tracing, and breadcrumbs
We found that dev-log-monitor demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
A fake corepack.org site is impersonating the Node.js tool and delivers an infostealer and proxyware to developers who download it.

Research
/Security News
A large-scale campaign abused GitHub Actions in compromised repositories to exploit CVE-2026-41940 in cPanel and WHM and steal server credentials.

Security News
Five frontier LLMs generated the same nonexistent package names, leaving 53 available for potential slopsquatting across PyPI and npm.