
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
pino-logflare
Advanced tools
A transport for Pino that sends messages to Logflare.
[!NOTE]
pino-logflare v0.5.0 and above is Pino +v7 compatible and remains backwards compatible.
npm install pino pino-logflare
Pino +v7 compatible transport.
const pino = require("pino")
const transport = pino.transport({
target: "pino-logflare",
options: {
apiKey: "your-api-key",
sourceToken: "your-source-token",
},
})
const logger = pino(transport)
logger.info("Hello Logflare!")
The default import should be used for all pino +v7 transport usage.
The createWriteStream
function creates a writestream. This is deprecated in favour of the default import of the package which is pino +v7 compatible.
contentWriteStream
const writeStream = createWriteStream({
apiKey: "API_KEY",
sourceToken: "49e4f31e-f7e9-4f42-8c1e-xxxxxxxxxx",
})
To handle ingestion errors, add in the following option:
const writeStream = createWriteStream({
apiKey: "API_KEY",
sourceToken: "49e4f31e-f7e9-4f42-8c1e-xxxxxxxxxx"
// optional callback, callback be invoked on each error raised
onError: (payload, err)=> {
// do something with the ingestion payload that would have been sent to Logflare.
}
});
To customize the payload, use the the onPreparePayload
option:
import { defaultPreparePayload } from "pino-logflare"
const writeStream = createWriteStream({
...,
// optional callback, by default, the received object will be nested under the `metadata` key
onPreparePayload: (payload, meta)=> {
// the `meta` arg contains cleaned information of raw payload
// You can add in top-level keys via this callback, or completely disable `metadata` key nesting by passing the payload as is, as shown below.
const item = defaultPreparePayload(payload, meta)
item["my_custom_key"] = "some value'
return item
}
});
The createPinoBrowserSend
function creates a writestream to send log events from the browser.
Example:
const send = createPinoBrowserSend({
apiKey: "API_KEY",
sourceToken: "49e4f31e-f7e9-4f42-8c1e-xxxxxxxxxx",
})
Option | Type | Description |
---|---|---|
apiKey | Required, string | Your Logflare API key |
sourceToken | Required, string | Your Logflare source token |
apiBaseUrl | Optional, string | Custom API endpoint (defaults to Logflare's API) |
size | Optional, number | Number of logs to batch before sending (defaults to 1) |
onPreparePayload | Optional, callback | Function to transform log payloads before sending |
onError | Optional, Object | Object with a module and method to be invoked on the worker thread.errors |
batchSize | Optional, number | Number of logs to batch before sending (defaults to 100) |
batchTimeout | Optional, number | Time in milliseconds to wait before sending partial batch (defaults to 1000) |
Note: batchSize
and batchTimeout
options are available only for Pino +v7.
The following options are deprecated and will be removed in a future version:
Option | Status | Migration |
---|---|---|
transforms | Deprecated | Server-side transforms are no longer supported. |
endpoint | Deprecated | Use apiBaseUrl instead |
fromBrowser | Deprecated | This option is no longer necessary for the HTTP Client. |
# install pino-logflare globally
$ npm install -g pino-logflare
# pipe text to be logged
$ echo "this is a test" | pino-logflare --key YOUR_KEY --source YOUR_SOURCE_ID
# with custom API URL
$ echo "this is a test" | pino-logflare --key YOUR_KEY --source YOUR_SOURCE_ID --url https://custom.logflare.app
Given an application index.js
that logs via pino, you would use pino-logflare
like so:
// index.js
const logger = require("pino")()
logger.info("hello world")
const child = logger.child({ property: "value" })
child.info("hello child!")
$ node index.js | pino-logflare --key YOUR_KEY --source YOUR_SOURCE_ID
You can pass the following options via cli arguments or use the environment variable associated:
Short command | Full command | Environment variable | Description |
---|---|---|---|
-k | --key <apikey> | LOGFLARE_API_KEY | The API key that can be found in your Logflare account |
-s | --source <source> | LOGFLARE_SOURCE_TOKEN | Default source for the logs |
-u | --url <url> | LOGFLARE_URL | Custom Logflare API URL (optional) |
To use pino-logflare
in your Vercel project you have to configure:
send
function to handle log events from the browser clientExample:
import pino from "pino"
import { logflarePinoVercel } from "pino-logflare"
// create pino-logflare console stream for serverless functions and send function for browser logs
const { stream, send } = logflarePinoVercel({
apiKey: "YOUR_KEY",
sourceToken: "XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXX",
})
// create pino logger
const logger = pino(
{
browser: {
transmit: {
level: "info",
send: send,
},
},
level: "debug",
base: {
env: process.env.VERCEL_ENV,
revision: process.env.VERCEL_GITHUB_COMMIT_SHA,
},
},
stream,
)
npm i
npm run build
npm test
npm run test.watch
# e2e tests
npm run start:api
npm run test:e2e
MIT
FAQs
A transport for Pino v7 that sends messages to Logflare
The npm package pino-logflare receives a total of 4,365 weekly downloads. As such, pino-logflare popularity was classified as popular.
We found that pino-logflare demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.