
Research
NPM targeted by malware campaign mimicking familiar library names
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
EWL provides common defaults for logging in an express application using winston.
EWL (express-winston-logger) provides common defaults for logging in an express application using winston. It is pre-configured with request tracing enabled and extends some of the features provided by express-winston, e.g. body blacklisting redaction.
yarn add ewl
import { Ewl } from 'ewl';
const ewl = new Ewl();
ewl.debug('This logs to the console by default.');
index.ts
:
import { Application } from 'express';
import { ewl, initEwl } from './logger';
const app = express() as Application;
initEwl(app);
const port = 3000;
app.listen(port, () => {
ewl.debug(`App: Listening on port ${port}!`);
});
logger/index.ts
:
import { Application } from 'express';
import { Ewl, LogLevel } from 'ewl';
export let ewl: Ewl;
export function initEwl(app: Application): void {
ewl = new Ewl({
enableRequestLogging: true,
environment: process.env.ENVIRONMENT || 'development',
label: 'app',
logLevel: (process.env.LOG_LEVEL as LogLevel) || 'error',
useLogstashFormat: false,
version: process.env.VERSION || 'unknown',
});
// Use context middleware to inject the request id.
app.use(ewl.contextMiddleware);
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
}
main.ts
:
import { NestFactory } from '@nestjs/core';
import { Ewl, LogLevel } from 'ewl';
import { AppModule } from './app.module';
async function bootstrap() {
const ewl = new Ewl({
enableRequestLogging: true,
environment: process.env.ENVIRONMENT || 'development',
label: 'app',
logLevel: (process.env.LOG_LEVEL as LogLevel) || 'error',
useLogstashFormat: false,
version: process.env.VERSION || 'unknown',
});
// Set the default NestJS logger, allowing EWL to be the proxy.
const app = await NestFactory.create(AppModule, { logger: ewl });
// Use context middleware to inject the request id.
app.use(ewl.contextMiddleware);
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
ewl.debug('Starting application on localhost:3000');
await app.listen(3000, 'localhost');
}
bootstrap();
express-winston
Request Logger Middlewareconst ewl = new Ewl({
enableRequestLogging: false,
requestLoggingOptions: {
bodyBlacklist: ['accessToken', 'password', 'refreshToken'],
colorize: true,
expressFormat: true,
headerBlacklist: ['cookie', 'token'],
meta: true,
metaField: 'express',
requestWhitelist: ['body', 'headers', 'method', 'params', 'query', 'url'],
responseWhitelist: ['body', 'headers', 'statusCode'],
statusLevels: true,
},
});
// Use request middleware to inject express metadata.
app.use(ewl.requestMiddleware);
MIT License
Contributions are encouraged, please see further details below:
Here are some basic rules to follow to ensure timely addition of your request:
main
branch. Any other branch (unless specified by the
maintainers) will get rejected.FAQs
EWL provides common defaults for logging in an express application using winston.
The npm package ewl receives a total of 6 weekly downloads. As such, ewl popularity was classified as not popular.
We found that ewl demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovered npm malware campaign mimicking popular Node.js libraries and packages from other ecosystems; packages steal data and execute remote code.
Research
Socket's research uncovers three dangerous Go modules that contain obfuscated disk-wiping malware, threatening complete data loss.
Research
Socket uncovers malicious packages on PyPI using Gmail's SMTP protocol for command and control (C2) to exfiltrate data and execute commands.