Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
express-pino-logger
Advanced tools
An express middleware to log with pino. Incidentally, it also works without express.
To our knowledge, express-pino-logger
is the fastest express logger in town.
Notice: This is a "meta-package" that only exists for search purposes and internally just exports pino-http
under a different name without any additional changes or features (see #41).
Benchmarks log each request/response pair while returning
'hello world'
, using
autocannon with 100
connections and 10 pipelined requests (autocannon -c 100 -p 10 http://localhost:3000
).
express-bunyan-logger
: 2702 req/secexpress-winston
: 5953 req/secmorgan
: 8570 req/secexpress-pino-logger
: 9807 req/secexpress-pino-logger
(extreme): 10407 req/secexpress-pino-logger
(without express): 22240.73 req/seqexpress-pino-logger
(without express and extreme): 25536 req/secAll benchmarks where taken on a Macbook Pro 2013 (2.6GHZ i7, 16GB of RAM).
Whilst we're comparing express-pino-logger
against morgan, this isn't really a fair contest.
Morgan doesn't support logging arbitrary data, nor does it output JSON. Further Morgan uses a form of eval
to achieve high speed logging. Whilst probably safe, using eval
at all tends to cause concern, particular when it comes to server-side JavaScript.
The fact that express-pino-logger
achieves higher throughput with JSON logging and arbitrary data, without using eval
, serves to emphasise the high-speed capabilities of express-pino-logger
.
With express-pino-logger
you can have features, safety and speed.
npm i express-pino-logger --save
'use strict'
var app = require('express')()
var pino = require('express-pino-logger')
app.use(pino)
app.get('/', function (req, res) {
// each request has its own id
// so you can track the log of each request
// by using `req.log`
// the ids are cycled every 2^31 - 2
req.log.info('something else')
res.send('hello world')
})
app.listen(3000)
$ node example.js | pino-pretty
[2016-03-31T16:53:21.079Z] INFO (46316 on MBP-di-Matteo): something else
req: {
"id": 1,
"method": "GET",
"url": "/",
"headers": {
"host": "localhost:3000",
"user-agent": "curl/7.43.0",
"accept": "*/*"
},
"remoteAddress": "::1",
"remotePort": 64386
}
[2016-03-31T16:53:21.087Z] INFO (46316 on MBP-di-Matteo): request completed
res: {
"statusCode": 200,
"header": "HTTP/1.1 200 OK\r\nX-Powered-By: Express\r\nContent-Type: text/html; charset=utf-8\r\nContent-Length: 11\r\nETag: W/\"b-XrY7u+Ae7tCTyyK7j1rNww\"\r\nDate: Thu, 31 Mar 2016 16:53:21 GMT\r\nConnection: keep-alive\r\n\r\n"
}
responseTime: 10
req: {
"id": 1,
"method": "GET",
"url": "/",
"headers": {
"host": "localhost:3000",
"user-agent": "curl/7.43.0",
"accept": "*/*"
},
"remoteAddress": "::1",
"remotePort": 64386
}
The req
object for logging is constructed by pino-std-serializers and custom properties added to the req
in previous middleware are not automatically included.
The original req
is accessible in the custom serializer under req.raw
.
'use strict'
var app = require('express')()
var ExpressPinoLogger = require('express-pino-logger')()
var pino = ExpressPinoLogger({
serializers: {
req: (req) => ({
method: req.method,
url: req.url,
user: req.raw.user,
}),
},
})
// middleware that augments the req - must be added before the pino middleware
app.use((req, res, next) => {
req.user = 'testing';
next();
})
app.use(pino)
...
express-pino-logger
has the same options of
pino, look at them there.
express-pino-logger
attaches some listeners to the request, so that
it will log when the request is completed.
You can also reuse an instance of pino
by passing it in the
constructor with:
'use strict'
const pino = require('pino')()
const expressPino = require('express-pino-logger')({
logger: pino
})
MIT
FAQs
An express middleware to log with pino
The npm package express-pino-logger receives a total of 53,526 weekly downloads. As such, express-pino-logger popularity was classified as popular.
We found that express-pino-logger demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.