
Research
/Security News
OpenAPI React Query Codegen Compromised in Mini Shai-Hulud npm Supply Chain Attack
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.
tracebug-sdk
Advanced tools
Zero-backend, browser-only SDK that records user sessions and generates bug reproduction steps. Data stays in localStorage.
One-stop bug reproduction tool for QA testers and developers. Records user sessions, captures screenshots, and auto-generates developer-ready bug reports — all in the browser.
Minimum effort from tester. Maximum debugging output for developer.
No servers. No databases. No API keys. Just npm install and go.
Works with any frontend framework: React, Angular, Vue, Next.js, Nuxt, Vite, Svelte, SvelteKit, Remix, Astro, or plain HTML.
Tester uses the app normally
↓
SDK silently captures: clicks, inputs, navigation, API calls, errors, environment
↓
Tester finds a bug → clicks 📸 Screenshot → adds a note ("Expected X, got Y")
↓
Clicks "GitHub Issue" or "Jira Ticket"
↓
Complete bug report copied to clipboard:
- Auto-generated title
- Steps to reproduce
- Screenshots
- Console errors + stack traces
- Failed network requests
- Environment (browser, OS, viewport)
- Full session timeline
↓
Paste into GitHub/Jira → Developer has everything. No back-and-forth.
npm install tracebug-sdk
import TraceBug from "tracebug-sdk";
TraceBug.init({ projectId: "my-app" });
| What | Details |
|---|---|
| Clicks | Element tag, text, id, className, aria-label, role, data-testid, href, button type |
| Inputs | Field name, type, value (sensitive fields auto-redacted), placeholder |
| Dropdowns | Selected option text + value, all available options |
| Form Submits | Form id, action, method, all field values (passwords redacted) |
| Navigation | Route from → to (supports pushState, replaceState, popstate) |
| API Requests | URL, method, status code, response time (both fetch and XMLHttpRequest) |
| Errors | Message, stack trace, source file, line, column |
| Console Errors | console.error() calls |
| Unhandled Rejections | Promise rejection reason + stack |
| Environment | Browser, OS, viewport, device type, connection, language, timezone |
| Tool | What it does |
|---|---|
| 📸 Screenshot | Captures page screenshot with auto-generated name (e.g., 01_click_add_vendor.png) |
| 📝 Add Note | Tester adds Expected/Actual/Severity — becomes part of the bug report |
| 🐙 GitHub Issue | Generates complete GitHub issue markdown — copies to clipboard |
| 🎫 Jira Ticket | Generates Jira-compatible ticket with priority, labels, description |
| 📄 PDF Report | Opens printable bug report — save as PDF from browser |
| Output | Details |
|---|---|
| Bug Title | Smart title from session context (e.g., "Vendor Update Fails — TypeError") |
| Repro Steps | Numbered steps generated from event timeline |
| Session Timeline | Debug timeline with elapsed timestamps for every event |
| Environment Snapshot | Browser version, OS, viewport, device type, connection |
npm install tracebug-sdk
npm install github:prashantsinghmangat/tracebug-ai
TraceBug.init({
projectId: "my-app", // Required: identifies your app
maxEvents: 200, // Max events per session (default 200)
maxSessions: 50, // Max sessions in localStorage (default 50)
enableDashboard: true, // Show the floating bug button (default true)
enabled: "auto", // Control when SDK is active (see below)
});
enabled option| Value | Behavior |
|---|---|
"auto" | Enabled in dev/staging, disabled in production (default) |
"development" | Only when NODE_ENV is "development" |
"staging" | Dev + staging hosts (staging, stg, uat, qa in hostname) |
"all" | Always enabled, including production |
"off" | Completely disabled |
string[] | Custom hostnames, e.g. ["localhost", "staging.myapp.com"] |
import TraceBug from "tracebug-sdk";
TraceBug.pauseRecording();
TraceBug.resumeRecording();
TraceBug.isRecording();
TraceBug.getSessionId();
TraceBug.destroy();
// Capture screenshot (auto-named from last event context)
const screenshot = await TraceBug.takeScreenshot();
// → { filename: "01_click_add_vendor.png", dataUrl: "data:image/png;...", ... }
const allScreenshots = TraceBug.getScreenshots();
TraceBug.addNote({
text: "Button doesn't respond after selecting Inactive status",
expected: "Vendor should update successfully",
actual: "App throws TypeError and freezes",
severity: "critical", // "critical" | "major" | "minor" | "info"
});
// Generate complete bug report object
const report = TraceBug.generateReport();
// Get auto-generated bug title
const title = TraceBug.getBugTitle();
// → "Vendor Update Fails — TypeError"
// Get GitHub issue markdown (copies to clipboard in dashboard)
const markdown = TraceBug.getGitHubIssue();
// Get Jira ticket payload
const ticket = TraceBug.getJiraTicket();
// → { summary, description, environment, priority, labels }
// Download PDF report
TraceBug.downloadPdf();
// Get environment info
const env = TraceBug.getEnvironment();
// → { browser: "Chrome", browserVersion: "122", os: "Windows 10/11", ... }
import { getAllSessions, clearAllSessions, deleteSession } from "tracebug-sdk";
const sessions = getAllSessions();
const bugs = sessions.filter(s => s.errorMessage);
clearAllSessions();
deleteSession("session-id");
import {
generateReproSteps,
captureEnvironment,
buildReport,
generateGitHubIssue,
generateJiraTicket,
generateBugTitle,
buildTimeline,
formatTimelineText,
} from "tracebug-sdk";
The in-browser dashboard includes:
password, secret, token, ssn, credit)localStorage — nothing leaves the browser| Format | File | Works with |
|---|---|---|
ESM (import) | dist/index.js | Vite, Next.js, Nuxt, SvelteKit, modern webpack |
CJS (require) | dist/index.cjs | Angular CLI, older webpack, Node.js |
| TypeScript | dist/index.d.ts | Full type support in both modes |
npm uninstall tracebug-sdk
Then remove the TraceBug.init() call from your app's entry file.
MIT
FAQs
Capture a browser bug into one offline .html file your AI coding agent reads over MCP and fixes — session replay, console, network, repro timeline, and a generated failing test. Local-first, zero backend. Free.
The npm package tracebug-sdk receives a total of 22 weekly downloads. As such, tracebug-sdk popularity was classified as not popular.
We found that tracebug-sdk demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Ten malicious OpenAPI React Query Codegen versions were published to npm in the Mini Shai-Hulud attack, all with valid provenance.

Security News
Socket joins more than 100 technology, cybersecurity, and financial organizations calling for a global surge in cyber defense.

Product
Enterprise security teams can now detect malware, credential theft, suspicious network activity, and risky updates across Microsoft Edge extensions.