
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A framework-agnostic TypeScript frontend user behavior tracking logger with automatic detection and manual instrumentation support
一个轻量级、框架无关的纯 TypeScript 前端用户行为追踪日志框架。
npm install lorine
import { init } from 'lorine';
// 初始化追踪器
const tracer = await init({
userId: 'user_123',
uploadUrl: 'https://api.example.com/logs',
trackers: {
route: { enabled: true },
click: { enabled: true },
form: { enabled: true },
api: { enabled: true },
error: { enabled: true }
}
});
// 之后所有用户行为将自动追踪
// 追踪自定义业务事件
tracer.trackCustom('purchase_completed', {
orderId: 'order_789',
amount: 6999,
paymentMethod: 'wechat'
});
interface TracerConfig {
// 用户标识
userId?: string;
// 上报配置
uploadUrl?: string;
uploadInterval?: number; // 上报间隔 (毫秒)
maxBatchSize?: number; // 批量大小
// 追踪器配置
trackers?: {
route?: RouteTrackerConfig;
click?: ClickTrackerConfig;
form?: FormTrackerConfig;
api?: APITrackerConfig;
error?: ErrorTrackerConfig;
custom?: CustomTrackerConfig;
};
// 敏感字段过滤
sensitiveFields?: string[]; // 默认: ['password', 'token']
// 调试模式
debug?: boolean;
}
tracer.init({
trackers: {
click: {
enabled: true,
// 只追踪特定元素
includeSelectors: ['button', 'a', '[data-track]'],
// 排除某些元素
excludeSelectors: ['.no-track'],
// 节流时间 (毫秒)
throttle: 300,
// 是否捕获文本内容
captureText: true,
// 是否捕获点击位置
capturePosition: true
}
}
});
tracer.init({
trackers: {
form: {
enabled: true,
// 排除敏感表单
excludeSelectors: ['#login-form', '.sensitive'],
// 是否捕获字段内容
captureFields: true
}
}
});
tracer.init({
trackers: {
api: {
enabled: true,
// 排除某些 URL
excludeUrls: ['/internal-api'],
// 是否捕获请求体
captureRequestBody: true,
// 是否捕获响应体
captureResponseBody: true
}
}
});
每条日志事件包含以下信息:
interface LogEvent {
id: string; // 事件唯一ID
type: EventType; // 事件类型 (route/click/form/api/error/custom)
timestamp: number; // 时间戳
sequence: number; // 序列号
sessionId: string; // 会话ID
userId?: string; // 用户ID
deviceId: string; // 设备指纹
payload: any; // 事件数据
metadata: { // 元数据
url: string;
userAgent: string;
viewport: { width: number; height: number };
};
}
// 查询日志
const logs = await tracer.queryLogs({
sessionId: 'session_xyz',
type: 'click',
startTime: Date.now() - 3600000,
limit: 100
});
// 导出日志
await tracer.exportLogs('json', 'logs.json');
await tracer.exportLogs('csv', 'logs.csv');
// 清空日志
await tracer.clearLogs();
// 获取日志数量
const count = await tracer.getLogCount();
// 清理过期日志 (7天前)
const deleted = await tracer.cleanupOldLogs(7 * 24 * 60 * 60 * 1000);
// 获取会话信息
const sessionId = tracer.getSessionId();
const deviceId = tracer.getDeviceId();
// 设置用户ID
tracer.setUserId('user_456');
// 启动/停止特定追踪器
tracer.startTracker('click');
tracer.stopTracker('click');
// 启动/停止所有追踪器
tracer.startAllTrackers();
tracer.stopAllTrackers();
// 自动追踪所有点击和页面访问
const tracer = await init({
trackers: {
route: { enabled: true },
click: { enabled: true }
}
});
// 分析用户点击热力图
const clickLogs = await tracer.queryLogs({ type: 'click' });
// 自动捕获所有 JS 错误
const tracer = await init({
trackers: {
error: { enabled: true, captureStackTrace: true }
}
});
// 查询错误日志
const errors = await tracer.queryLogs({ type: 'error' });
// 追踪所有 API 请求
const tracer = await init({
trackers: {
api: { enabled: true }
}
});
// 分析慢请求
const apiLogs = await tracer.queryLogs({ type: 'api' });
const slowRequests = apiLogs.filter(log => log.payload.duration > 3000);
// 关键步骤埋点
tracer.trackCustom('view_product', { productId: '001' });
tracer.trackCustom('add_to_cart', { productId: '001' });
tracer.trackCustom('checkout_start', { amount: 6999 });
tracer.trackCustom('payment_success', { orderId: '789' });
// 查询转化路径
const funnel = await tracer.queryLogs({
type: 'custom',
sessionId: currentSessionId
});
在 HTML 中使用 data-track-* 属性:
<button
data-track="purchase"
data-track-category="商品"
data-product-id="001"
data-price="6999">
立即购买
</button>
点击时自动记录所有 data-* 属性。
{
"exportTime": 1737878500000,
"version": "1.0",
"count": 150,
"events": [
{
"id": "evt_abc123",
"type": "click",
"timestamp": 1737878400000,
"sessionId": "session_xyz",
"payload": { ... }
}
]
}
id,type,timestamp,sequence,sessionId,userId,url,payloadSummary
evt_abc123,click,1737878400000,1,session_xyz,user_456,/products,点击: 加入购物车按钮
框架自动过滤敏感信息:
[FILTERED]138****8888us****@example.comtracer.init({
sensitiveFields: ['password', 'token', 'ssn', 'creditCard']
});
# 安装依赖
npm install
# 开发模式
npm run dev
# 构建
npm run build
# 测试
npm test
MIT
欢迎提交 Issue 和 Pull Request!
FAQs
A framework-agnostic TypeScript frontend user behavior tracking logger with automatic detection and manual instrumentation support
We found that lorine demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.