Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
pony-cause
Advanced tools
Ponyfill and helpers for Error Causes
ErrorWithCause
, creating an error with a causeconst { ErrorWithCause } = require('pony-cause');
try {
// Something that can break
} catch (err) {
throw new ErrorWithCause('Failed doing what I intended', { cause: err });
}
stackWithCauses
, getting full stack trace for error + all causesconst { stackWithCauses } = require('pony-cause');
try {
// Something that can break
} catch (err) {
console.log('We had a mishap:', stackWithCauses(err));
}
The output is similar to VError.fullStack()
but resolves causes in both Error Causes style, .cause
, and VError style, .cause()
.
Note: stackWithCauses
has protection against circular causes
Output looks like:
Error: something really bad happened here
at Object.<anonymous> (/examples/fullStack.js:5:12)
at Module._compile (module.js:409:26)
at Object.Module._extensions..js (module.js:416:10)
at Module.load (module.js:343:32)
at Function.Module._load (module.js:300:12)
at Function.Module.runMain (module.js:441:10)
at startup (node.js:139:18)
at node.js:968:3
caused by: Error: something bad happened
at Object.<anonymous> (/examples/fullStack.js:3:12)
at Module._compile (module.js:409:26)
at Object.Module._extensions..js (module.js:416:10)
at Module.load (module.js:343:32)
at Function.Module._load (module.js:300:12)
at Function.Module.runMain (module.js:441:10)
at startup (node.js:139:18)
at node.js:968:3
messageWithCauses
, getting an error message which includes all causesconst { messageWithCauses, ErrorWithCause } = require('pony-cause');
try {
try {
throw new Error('First error');
} catch (err) {
throw new ErrorWithCause('Second error', { cause: err });
}
} catch (err) {
// Logs: "Second error: First error"
console.log(messageWithCauses(err));
}
The output is similar to the standard VError
behaviour of appending message
with the cause.message
, separating the two with a :
.
Since Error Causes doesn't do this, messageWithCauses
exist to mimic that behaviour.
It respects VError
messages, it won't append any error message of their causes, though it will walk past the VError
causes to see if there's a non-VError cause up the chain and then append that.
The reason to use this method is explained by VError
:
The idea is that each layer in the stack annotates the error with a description of what it was doing. The end result is a message that explains what happened at each level.
If an inner error has a message ENOENT, stat '/nonexistent'
, an outer error wraps it and adds Can't perform X
and maybe one more error wraps that and adds Can't start program
, then messageWithCauses
will join those three errors together when providing it with the outer most error and return Can't start program: Can't perform X: ENOENT, stat '/nonexistent'
which provides details about both cause and effect as well as the connection between the two – each which on their own would be a lot harder to understand the impact of.
Note: messageWithCauses
has protection against circular causes
getErrorCause
, getting the cause of an errorconst { getErrorCause } = require('pony-cause');
try {
// Something that can break
} catch (err) {
const cause = getErrorCause(err);
}
The output is similar to VError.cause()
but resolves causes in both Error Causes style, .cause
, and VError style, .cause()
.
Always return an Error
, a subclass of Error
or undefined
. If a cause in Error Causes style cause is not an Error
or a subclass of Error
, it will be ignored and undefined
will be returned.
findCauseByReference
, finding a specific type of error in the cause chainconst { findCauseByReference } = require('pony-cause');
try {
// Something that can break
} catch (err) {
/** @type {MySpecialError} */
const specialErr = findCauseByReference(err, MySpecialError);
if (specialErr && specialErr.specialProperty === 'specialValue') {
// Its okay, chill!
} else {
throw err;
}
}
Used to find a specific type of error in the chain of causes in an error.
Similar to VError.findCauseByName
but resolves causes in both Error Causes style, .cause
, and VError style, .cause()
+ takes a reference to the Error class that you are looking for rather than simply the name of it, as that enables the TypeScript types to properly type the returned error, typing it with the same type as the reference.
Can be useful if there's some extra data on it that can help determine whether it's an unexpected error or an error that can be handled.
If it's an error related to a HTTP request, then maybe the request can be retried? If its a database error that tells you about a duplicated row, then maybe you know how to work with that? Maybe forward that error to the user rather than show a 500
error?
Note: findCauseByReference
has protection against circular causes
verror
– a module which has long enabled error causes in javascript. Superseded by the new Error Cause proposal. Differs in that.cause
represents a function that returns the cause, its not the cause itself.@netflix/nerror
– a Netflix fork of verror
error-cause
– strict polyfill for the Error Cause proposal. Provides no helpers or similar to achieve VError
-like functionality, which pony-cause
does.FAQs
Ponyfill and helpers for Error Causes
We found that pony-cause demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.