
Security News
Node.js Drops Bug Bounty Rewards After Funding Dries Up
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.
log4njs is a very simple log utility for nodejs & typescript.
npm i log4njs --save
See CHANGELOG for breaking changes.
import { getLogger } from 'log4njs';
const log = getLogger();
$ log.info('Hello world', { foo: 'bar' });
> '[INFO] Hello world' { foo: 'bar' }
LogLevel. The log level of the logger instance. Defaults to INFO (300).''.false.false.
false.Example
import { getLogger, LogLevel } from 'log4njs';
const log = getLogger({ level: LogLevel.DEBUG, prefix: 'MyPrefix::', timstamp: true });
LOG_LEVEL=ERRORLOG_PREFIX=MyPrefix::LOG_TIMESTAMP=trueLOG_CALLERINFO=trueLOG_HIDE_LOG_LEVEL=trueSettings can be modified after the logger has been created:
const log = getLogger({ timstamp: true });
log.info('Foo');
log.getSettings().timestamp = false;
log.info('Bar');
log.getSettings().timestamp = true;
log.info('Baz');
> [INFO] 2024-01-14T13:35:08.683Z Foo
> [INFO] Bar
> [INFO] 2024-01-14T13:35:40.637Z Baz
In unit tests, for example, you may want to suppress all log statements:
$ LOG_LEVEL=suppress npm test
There are two Audit log level, introduced in 2.1.0.: AUDIT & AUDIT_ALERT.
They can only be turned off by suppressing all logs.
Audit logging is typically sensitive and important but monitored separate from error logs which is why these two new log levels were introduced.
Each log level corresponds to a valid configuration value.
$ log.trace(message[, attachment]);
> [TRACE] ...
$ log.debug(message[, attachment]);
> [DEBUG] ...
$ log.info(message[, attachment]);
> [INFO] ...
$ log.warning(message[, attachment]);
> [WARNING] ...
$ log.error(message[, attachment]);
> [ERROR] ...
$ log.critical(message[, attachment]);
> [CRITICAL] ...
$ log.audit(message[, attachment]);
> [AUDIT] ...
$ log.auditAlert(message[, attachment]);
> [AUDIT_ALERT] ...
To ensure that certain values are not printed to the log you can mask data.
Note: It is important to clear the masks after you are done, or it may cause a memory leak over time.
Note: Masks are case-sensitive. The exact string provided will be masked, nothing else.
let data = { id: 12, secret: 'abc123' };
try {
log.addMask(data.secret);
log.info('My masked log', data);
> '[INFO] My masked log' { id: 12, secret: '***' }
} finally {
log.clearMasks();
log.info('My masked log', data);
> '[INFO] My masked log' { id: 12, secret: 'abc123' }
}
You can optionally set a custom placeholder
let data = { id: 12, secret: 'abc123' };
log.addMask(data.secret, 'placeholder');
log.info('My masked log', data);
> '[INFO] My masked log' { id: 12, secret: 'placeholder' }
There are a couple of sample scripts provided to highlight the performance impact of various configurations.
All benchmarks run 10000 iterations.
Before running the benchmarks, run:
cd resources/benchmarks
npm i
Default logging with or without a simple attachment:
Sample, with attachment:
node default-use.js true
> default benchmark: true: 141.929ms
Sample, without attachment:
node default-use.js
> default benchmark: false: 133.035ms
Debug logging is usually disabled in production.
Log4njs provides the option to do a pre-check when debug logging to increase performance when debug logging is turned off.
Note that this does take a slight performance hit when debug logging is turned on.
Sample, with check enabled:
node check-debug.js true
> isDebugEnabled benchmark: true: 0.604ms
Sample, with check disabled:
node check-debug.js
> isDebugEnabled benchmark: false: 0.91ms
The callerInfo setting will attempt to extract the filename & line number of the caller.
This provides useful information when it is difficult to pinpoint the source of a specific logger call but takes a fairly big performance hit.
Sample, with callerInfo enabled:
node resources/benchmarks/caller-info.js true
> CallerInfo benchmark: true: 627.254ms
Sample, with callerInfo disabled (equivalent to default use with no attachment):
node resources/benchmarks/caller-info.js
CallerInfo benchmark: false: 140.666ms
FAQs
A very simple log utility for nodejs & typescript
We found that log4njs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.