Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
The 'log' npm package is a lightweight logging library for Node.js. It provides simple logging capabilities, allowing developers to output messages to the console with various levels of severity, such as debug, info, warn, and error. It is designed to be minimalistic and straightforward to use.
Logging messages with different severity levels
This feature allows developers to log messages with different levels of importance. The 'log' package provides methods like debug, info, warn, and error to categorize log messages.
const log = require('log');
log.debug('Debug message');
log.info('Information message');
log.warn('Warning message');
log.error('Error message');
Custom log levels
Developers can set a custom log level to control which messages should be output. For example, setting the log level to 'error' will only output error messages, suppressing less severe messages.
const log = require('log');
log.level = 'debug';
log.debug('This debug message will be logged');
log.level = 'error';
log.debug('This debug message will NOT be logged');
Custom log output
The 'log' package allows developers to define a custom output function for log messages. This can be used to redirect log output to a file, a remote logging service, or any other custom handling.
const log = require('log');
log.use({ write: (message) => {/* Custom logic to output message */} });
Winston is a multi-transport async logging library for Node.js. It is more feature-rich than 'log', supporting multiple storage options, custom formats, and log rotation. It is suitable for more complex logging needs.
Bunyan is a simple and fast JSON logging library for Node.js services. It includes features like log rotation, streams, and serializers. It is comparable to 'log' but focuses on structured logging in JSON format.
Pino is a very low overhead Node.js logger, which is inspired by Bunyan. It focuses on performance and includes features like child loggers and custom serializers. It is an alternative to 'log' with a focus on high-performance use cases.
Morgan is an HTTP request logger middleware for Node.js. It is designed to log HTTP requests for web applications, especially in combination with frameworks like Express.js. It differs from 'log' by being specialized for HTTP context.
Configurable, environment and presentation agnostic, with log levels and namespacing (debug style) support
// Default logger (writes at 'info' level)
const log = require("log");
// Log 'info' level message:
log.info("some info message %s", "injected string");
// Get namespaced logger (debug lib style)
const myLibLog = log.get("my-lib");
// Log 'info' level message in context of 'my-lib' namespace:
myLibLog.info("some info message in 'my-lib' namespace context");
// Namespaces can be further nested
const myLibFuncLog = log.get("func");
// Log 'info' level message in context of 'my-lib:func' namespace:
myLibFuncLog.info("some info message in 'my-lib:func' namespace context");
// Log 'error' level message in context of 'my-lib:func' namespace:
myLibFuncLog.error("some error message");
// log output can be dynamically enabled/disabled during runtime
const { restore } = myLibFuncLog.error.disable();
myLibFuncLog.error("error message not really logged");
// Restore previous logs visibiity state
restore();
myLibFuncLog.error("error message to be logged");
e.g. if target is Node.js, then install log-node
, and at the top of main module initialize it
require("log-node")();
Mirror of applicable syslog levels (in severity order):
debug
- debugging information (hidden by default)info
- a purely informational message (hidden by default)notice
- condition normal, but significantwarning
(also aliased as warn
) - condition warningerror
- condition error - to notify of errors accompanied with recovery mechanism (hence reported as log and not as uncaught exception)Note: critical
, alert
, emergency
are not exposed as seem to not serve a use case in context of JS applications,
such errors should be exposed as typical exceptions
log
doesn't force any specific arguments handling. Still it is recommended to assume printf-like message
format, as all currently available writers are setup to support it. Placeholders support reflects one implemented in Node.js format util
Excerpt from Node.js documentation:
The first argument is a string containing zero or more placeholder tokens. Each placeholder token is replaced with the converted value from the corresponding argument. Supported placeholders are:
%s
- String.%d
- Number (integer or floating point value).%i
- Integer.%f
- Floating point value.%j
- JSON. Replaced with the string '[Circular]' if the argument contains circular references.%o
- Object. A string representation of an object with generic JavaScript object formatting. Similar to util.inspect() with options { showHidden: true, depth: 4, showProxy: true }. This will show the full object including non-enumerable symbols and properties.%O
- Object. A string representation of an object with generic JavaScript object formatting. Similar to util.inspect() without options. This will show the full object not including non-enumerable symbols and properties.%%
- single percent sign ('%'). This does not consume an argument.Note to log writer configuration developers: For cross-env compatibility it is advised to base implementation on sprintf-kit
log
on its own doesn't write anything to the console or any other means (it just emits events to be consumed by preloaded log writers).
To have logs written, the pre-chosen log writer needs to be initialized in the main (starting) module of a process.
log-node
- For typical Node.js processeslog-aws-lambda
- For AWS lambda environmentNote: if some writer is missing, propose a PR
Default visibility depends on the enviroment (see chosen log writer for more information), and in most cases is setup through the following environment variables:
LOG_LEVEL
(defaults to notice
) Lowest log level from which (upwards) all logs will be exposed.
LOG_DEBUG
Eventual list of namespaces to expose at levels below LOG_LEVEL
threshold
List is comma separated as e.g. foo,-foo:bar
(expose all foo
but not foo:bar
).
It follows convention configured within debug. To ease eventual migration from debug, configuration fallbacks to DEBUG
env var if LOG_DEBUG
is not present.
When following env var is set writers are recommended to expose timestamps aside each log message
LOG_TIME
rel
(default) - Logs time elapsed since logger initializationabs
- Logs absolute time in ISO 8601 format$ npm test
Project cross-browser compatibility supported by:
To report a security vulnerability, please use the Tidelift security contact. Tidelift will coordinate the fix and disclosure.
FAQs
Universal pluggable logging utility
We found that log demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.