
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Lightweight request tracing for Node.js with Express, Axios and Winston support
Trace-Me is a lightweight Node.js package designed to simplify request tracing across your entire application stack. It provides seamless trace ID propagation through Express middleware, Axios requests, and Winston logging.
Trace-Me can be used in various parts of a Node.js ecosystem:
npm install trace-me
# or
yarn add trace-me
# or
pnpm add trace-me
import express from "express";
import { tracingMiddleware, logger } from "trace-me";
const app = express();
app.use(tracingMiddleware());
app.get("/", (req, res) => {
logger.info("Handling request");
res.send("Hello World!");
});
app.listen(3000, () => {
logger.info("Server started on port 3000");
});
import { tracingMiddleware } from "trace-me";
// Default usage
app.use(tracingMiddleware());
// Custom configuration
app.use(tracingMiddleware("x-custom-trace-id", ["error", "warn", "info"]));
headerName: Custom trace ID header (default: 'x-trace-id')levels: Array of log levels that include trace IDs (null = all)import { logger, updateLoggerTraceLevels } from "trace-me";
logger.info("This will include a trace ID if available");
updateLoggerTraceLevels(["error", "info"]);
updateLoggerTraceLevels(null); // Reverts to all levels
import { getAxiosInstance, setAxiosInstance } from "trace-me";
import axios from "axios";
// Default instance
await getAxiosInstance().get("https://api.example.com");
// Custom instance
const customAxios = axios.create({ baseURL: "https://api.example.com" });
setAxiosInstance(customAxios);
import { runWithContext, setTraceId, getTraceId } from "trace-me";
runWithContext(() => {
setTraceId("manual-trace-id");
console.log(getTraceId()); // → 'manual-trace-id'
});
import { setTraceIdHeader } from "trace-me";
setTraceIdHeader("x-custom-trace-id");
service-a/index.ts)import express from "express";
import { tracingMiddleware, getAxiosInstance, logger } from "trace-me";
const app = express();
app.use(tracingMiddleware());
app.get("/call-service-b", async (req, res) => {
const response = await getAxiosInstance().get("http://localhost:4000/data");
logger.info("Received response from Service B");
res.json({ from: "Service A", serviceB: response.data });
});
app.listen(3000, () => logger.info("Service A running on port 3000"));
service-b/index.ts)import express from "express";
import { tracingMiddleware, logger } from "trace-me";
const app = express();
app.use(tracingMiddleware());
app.get("/data", (req, res) => {
logger.info("Handled request in Service B");
res.json({
message: "Hello from Service B",
traceId: req.headers["x-trace-id"],
});
});
app.listen(4000, () => logger.info("Service B running on port 4000"));
import { runWithContext, setTraceId, logger } from "trace-me";
function runBackgroundJob() {
runWithContext(() => {
setTraceId(`job-${Date.now()}`);
logger.info("Running background job");
// Logic...
});
}
import { logger } from "trace-me";
try {
throw new Error("Something went wrong");
} catch (err) {
logger.error("Caught error", { error: err });
}
| Function | Description | Default |
|---|---|---|
tracingMiddleware(header, levels) | Apply trace ID middleware | 'x-trace-id', all levels |
updateLoggerTraceLevels(levels) | Control which log levels show trace IDs | null (all levels) |
setTraceIdHeader(name) | Globally set the trace header name | 'x-trace-id' |
setAxiosInstance(instance) | Set a custom Axios instance | Default Axios instance |
Trace IDs not showing in logs?
tracingMiddleware is applied before route handlersrunWithContext if working outside ExpressTrace ID missing in Axios?
getAxiosInstance() or call setAxiosInstance(...)Memory concerns?
AsyncLocalStorage is designed to avoid leaks. Avoid long-running contexts in runWithContext.MIT © Niraj Surve
Trace-Me helps bring full visibility to your Node.js applications with minimal setup. Whether you're building a monolith or microservices, this package adds traceability to every request, response, and log.
FAQs
Lightweight request tracing for Node.js with Express, Axios and Winston support
We found that trace-me demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.