
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
stack-tracer
Advanced tools
Global access to all CallSite/Stack Trace Properties and more
npm install stack-tracer
or
npm install -g stack-tracer
Then import the module into your program:
var trace = require('stack-tracer');
A Stack is a list of all active functions within the program in the order they were invoked
Every time a function is invoked, a corresponding CallSite Object is created and added to the Stack
Whenever a function returns, the CallSite corresponding to the invocation is removed from the Stack Trace
This module uses a common method of capturing the raw Stack Trace (an Array of CallSite Objects)
It then creates a Tracer Object containing information about a specific CallSite
Read more about the V8 Stack Trace/CallSite API here
A Tracer Object can be created multiple ways:
A Tracer Object can be created by invoking the exported function:
trace( [index] )
index - The index of the CallSite that the Tracer Object should be based on
0 will correspond to the immediate (this) invocationIt contains the following properties:
callSite
stack
trace
fileName
isNative
line
column
var trace = require('stack-tracer');
var myTracer = trace(); //or trace(0);
//myTracer.line = 3
//myTracer.column = 16
function getTracer(){
return trace();
}
myTracer = getTracer();
//myTracer.line = 8
//myTracer.column = 10
this
this value in the context of the invocationtypeName
this as a Stringvar trace = require('stack-tracer');
var myTracer = trace();
//myTracer.this = this
//myTracer.typeName = 'Object'
var myContext = [];
function getTracer(){
return trace();
}
myTracer = getTracer.call(myContext);
//myTracer.this = myContext
//myTracer.typeName = 'Array'
function
functionName
var trace = require('stack-tracer');
var myTracer = trace();
//myTracer.function = <<this entire script>>
//myTracer.functionName = null
function getTracer(){
return trace();
}
myTracer = getTracer();
//myTracer.function = getTracer
//myTracer.functionName = 'getTracer'
methodName
this which maps to the function where the invocation occurredvar trace = require('stack-tracer');
var myTracer = trace();
//myTracer.methodName = null
var myObj = {
'get' : function(){
return trace();
}
}
myTracer = myObj.get();
//myTracer.this = myObj
//myTracer.function = myObj.get
//myTracer.functionName = 'myObj.get'
//myTracer.methodName = 'get'
//Function can be named:
myObj = {
'get' : function getTracer(){
return trace();
}
}
myTracer = myObj.get();
//myTracer.functionName = 'getTracer'
isTopLevel
this the global object?var trace = require('stack-tracer');
var myTracer = trace();
//myTracer.isToplevel = true
function getTracer(){
return trace();
}
myTracer = getTracer();
//myTracer.isToplevel = true
myTracer = getTracer.call({});
//myTracer.isToplevel = false
isEval
evalOrigin
eval function where the invocation was definedvar trace = require('stack-tracer');
var myTracer = eval('trace()');
//myTracer.isEval = true
function getTracer(){
return eval('trace()');
}
myTracer = getTracer();
//myTracer.isEval = true
eval('function evalGetTracer(){ return trace() }');
myTracer = evalGetTracer();
//myTracer.isEval = true
isConstructor
var trace = require('stack-tracer');
var myTracer = trace();
//myTracer.isConstructor = false
function getTracer(){
return trace();
}
myTracer = getTracer();
//myTracer.isConstructor = false
myTracer = new getTracer();
//myTracer.isConstructor = true
caller
var trace = require('stack-tracer');
var myTracer = trace();
//myTracer.function = <<this entire script>>
//myTracer.functionName = null
function getTracer(){
return trace().caller; //or trace(1)
}
myTracer = getTracer();
//myTracer.function = <<this entire script>>
//myTracer.functionName = null
callee
var trace = require('stack-tracer');
var myTracer = trace();
//myTracer.callee = null
function getTracer(){
return trace().caller;
}
myTracer = getTracer();
//myTracer.callee.function = getTracer
//myTracer.callee.functionName = 'getTracer'
The module also adds a number of global properties which implicitly create a Tracer object at that location and return the corresponding property
It is the equivalent of invoking trace().<property>
The properties are all of the above properties, prefixed with '__':
__callSite
__stack
__trace
__caller
__callee
__fileName
__line
__column
__this
this value in the context of the invocation__typeName
this as a String__function
__functionName
__methodName
this which maps to the function where the invocation occurred__evalOrigin
eval function where the invocation was defined__isToplevel
this the global object?__isEval
__isNative
__isConstructor
var trace = require('stack-tracer');
__line //3, same as trace().line
__column //1, same as trace().column
function getTracer(){
if( __isConstructor ) return __caller //same as trace().caller or trace(1)
else return __trace //same as trace().trace or trace()
}
var myTracer = getTracer();
//myTracer.line = 8
//myTracer.column = 15
myTracer = new getTracer();
//myTracer.line = 15
//myTracer.column = 11
Every Error has a __stack property which contains the raw Stack Trace Array.
Note - The Error.stack property must be requested in order to invoke the creation of the __stack property
A Tracer Object can then be created from an Error by invoking the following:
trace.from( error )
error - The Error Object that the Tracer Object should be based onvar trace = require('stack-tracer');
var err = new Error();
//error.__stack = undefined
err.stack; //invoke the creation of the stack trace array
//err.__stack = <<Array of CallSites>>
var myTracer = trace.from( err );
//myTracer.line = 3
//myTracer.column = 11
FAQs
Global access to all CallSite/Stack Trace Properties and more
We found that stack-tracer demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.