Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
A service for streaming, storage and query of log data.
This is the client-side implementation for both Nodejs and the browser. For the server-side implementation and server public API, see log-sink-server.
npm install log-sink --save
var sink = require('log-sink'),
fs = require('fs')
// Connect to log sink server using a secure connection
sink.connect('my-user', 'my-password', {
host: 'localhost',
port: 8018,
secure: true,
// If the server is using a self-signed certificate,
// include it here
ca: fs.readFileSync('keys/self-signed-cert.pem')
})
// In the browser, use:
sink.connect('my-user', 'my-password', 'wss://localhost:8019')
// Write
// sink.{debug,info,warn,error,fatal}(name, [message], [extra])
// If the connection is not ready yet, it will be buffered and
// executed when it gets ready
sink.info('readme', 'My first log', ['custom data', 17])
sink.error('readme', new Error('We had a problem'))
// Or avoid typing the required name every time
var logger = sink.bindName('readme')
logger.debug('Got here!')
// Streaming
sink.stream(function (err, stream) {
if (err) throw err
// stream is a ReadableStream in object mode
stream.on('data', function (log) {
console.log(log)
})
// call stream.stop() when you are done
})
// Querying
sink.query({
level: {
min: sink.LEVEL.WARN
}
}, function (err, logs) {
if (err) throw err
console.log(logs)
})
The only difference between the use in Nodejs and browsers is the third connect
parameter. In Nodejs, it's an object; for browser it's the WS url.
Browsers will connect using WebSocket and Nodejs will use TCP directly. Note that the ports are NOT the same.
var sink = require('log-sink'),
conn = new sink.Connection,
conn2 = new sink.Connection
conn.connect('user', 'pass', options)
conn2.connect('user2', 'pass2', options2)
To understand more about log sink, read the doc on the server project
All public methods are described in the generated docs
FAQs
A service for streaming, storage and query of log data
The npm package log-sink receives a total of 3 weekly downloads. As such, log-sink popularity was classified as not popular.
We found that log-sink demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.