
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
[](https://nodei.co/npm/hpropagate/)
This package automatically propagates HTTP headers from inbound to outbound HTTP requests.
We use a micro-service architecture with a growing number of HTTP endpoints. We want to propagate certain HTTP headers received from the incoming HTTP requests to all subsequent outbound HTTP requests without the need for our engineers to do it programmatically in each services:
By default, the following headers are automatically propagated:
x-correlation-id. If the header is missing from the inbound request, it will be created with a UUID as value.x-variant-id to allow us to deploy multiple versions of the same services at the same time.x-feature-flags to allow us to dynamically turn on feature flags.x-request-id for tracingx-b3-traceid for tracingx-b3-spanid for tracingx-b3-parentspanid for tracingx-b3-sampled for tracingx-b3-flags for tracingx-ot-span-context for tracingApart from x-correlation-id, only headers received on the incoming request will be propagated to outbound calls.
The list of headers can be overriden and the initialisation of x-correlation-id disabled, see below
To use the default configuration:
// should have this line as early as possible in your code
// it must be before loading express and request
const hpropagate = require("hpropagate");
// then start it
hpropagate();
Or do it in one go:
require("hpropagate")();
hpropagate({
setAndPropagateCorrelationId: false,
});
hpropagate({
headersToPropagate: ["x-my-header", "x-another-header"],
});
You can also combine those, for example to disable the initialisation of the correlation id and only propagate it:
hpropagate({
setAndPropagateCorrelationId: false,
headersToPropagate: ["x-correlation-id"],
});
hpropagate({
propagateInResponses: true,
});
Inspiration from this talk (Slides and Code) and this module
The first goal is to be able to propagate certain headers (i.e. X-Correlation-ID) to outbound HTTP requests without the need to do it programmatically in the service.
It works by using a global tracer object which keeps a records of traces (a trace object per http request). The header value is saved in the trace object associated with the current request.
The http core code is wrapped to record headers on the trace (on the request listener of the http server set with http.createServer) and inject headers to the outbound requests (currently only on http.request).
Node's async_hooks module (new in Node 8) is used to set/reset tracer.currentTrace to the trace relevant to the current execution context. tracer.currentTrace is used in the wrapped functions to record/access the headers data.
Express 4FAQs
[](https://nodei.co/npm/hpropagate/)
The npm package hpropagate receives a total of 3,152 weekly downloads. As such, hpropagate popularity was classified as popular.
We found that hpropagate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.