
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Asynchronous route-level analytics for Express.js. Tracks latency, request data, and errors. Supports notifications via Teams, Slack, and Google Chat. MongoDB + BullMQ + Redis.
A minimal, production-ready route analytics toolkit for Express.js.
Tracks every request — latency, status codes, request metadata, and errors — and stores it asynchronously in MongoDB using BullMQ + Redis.
Built for SaaS platforms, internal tools, and teams who care about visibility without bloat.
npm install traxx
const express = require("express");
const Traxx = require("traxx");
const app = express();
const traxx = new Traxx({
mongoUri: process.env.MONGO_URI,
redisUri: process.env.REDIS_URI,
logIPAddress: true, //false by default
notifications: {
statusCodes: [404, 500], // or { min: 400, max: 599 } for all error codes
channels: [
{
type: 'teams',
options: {
webhookUrl: process.env.TEAMS_WEBHOOK_URL
}
},
{
type: 'slack',
options: {
webhookUrl: process.env.SLACK_WEBHOOK_URL
}
}
]
}
});
// Enable tracking middleware without any custom fields
app.use(traxx.middleware());
// if needed to add any custom fields for tracking purpose, like the tenantId
app.use((req, res, next) => traxx.middleware({tenantId: req.body.tenantId})(req, res, next))
// Example route
app.get("/shop/:id", (req, res) => {
res.json({ status: true, shop: req.params.id });
});
//Start the server and initialize the traxx
const port = process.env.PORT || 8080;
const server = app.listen(port, async () => {
await traxx.init(); // Connect to Mongo + Redis
console.log(`Listening on port ${port}...`);
});
Traxx ships with built‑in type declarations. No extra typings are required.
npm install traxx
// Option A: with esModuleInterop (recommended)
import Traxx from "traxx";
// Option B: without esModuleInterop
// import Traxx = require("traxx");
import express from "express";
import Traxx from "traxx";
const app = express();
const traxx = new Traxx({
mongoUri: process.env.MONGO_URI as string,
redisUri: process.env.REDIS_URI as string,
logIPAddress: true,
notifications: {
statusCodes: { min: 400, max: 599 },
channels: [
{
type: "teams",
options: { webhookUrl: process.env.TEAMS_WEBHOOK_URL as string },
},
],
},
});
// Enable tracking middleware
app.use(traxx.middleware());
// Add custom fields (e.g., tenantId)
app.use((req, res, next) =>
traxx.middleware({ tenantId: (req as any).tenantId })(req, res, next)
);
app.get("/shop/:id", (req, res) => {
res.json({ status: true, shop: req.params.id });
});
const port = Number(process.env.PORT) || 8080;
app.listen(port, async () => {
await traxx.init();
console.log(`Listening on port ${port}...`);
});
Traxx.TraxxOptionsModel<Traxx.TraxxLog>const Log = traxx.model();
const recent = await Log.find().sort({ timestamp: -1 }).limit(50);
{
"compilerOptions": {
"target": "ES2020",
"module": "CommonJS",
"esModuleInterop": true,
"skipLibCheck": true
}
}
| Field | Description |
|---|---|
route | Full URL path without query string |
method | GET, POST, etc. |
statusCode | Final response status |
latency | ms, calculated via process.hrtime() |
timestamp | ISO string |
requestBody | Parsed req.body |
requestParams | From req.params |
requestQuery | From req.query |
customFields | Anything that you pass in the middleware() |
ipAddress | From req.ip or req.headers["x-forwarded-for"] (optional, stored only if logIPAddress is set to true) |
Each request is stored as its own document — no pre-aggregation, full raw logs for full custom analytics.
Need to build your own dashboard or metrics?
const Log = traxx.model();//get the model instance
const recent = await Log.find().sort({ timestamp: -1 }).limit(50);
Traxx can send notifications to Teams, Slack, and Google Chat when specific status codes are encountered.
You can specify which status codes should trigger notifications in several ways:
// Specific status codes as an array
notifications: {
statusCodes: [404, 500, 503],
// ...
}
// Range of status codes
notifications: {
statusCodes: { min: 400, max: 599 }, // All 4xx and 5xx errors
// ...
}
Configure one or more notification channels:
notifications: {
statusCodes: [500],
channels: [
{
type: 'teams',
options: {
webhookUrl: 'https://outlook.office.com/webhook/...'
}
},
{
type: 'slack',
options: {
webhookUrl: 'https://hooks.slack.com/services/...'
}
},
{
type: 'googleChat',
options: {
webhookUrl: 'https://chat.googleapis.com/v1/spaces/...'
}
}
]
}
Notifications include all data that is tracked in the database:
This comprehensive data helps you quickly identify and diagnose issues when they occur, with all the context you need to reproduce and fix problems.
Notifications automatically include detailed error information when available:
This helps you quickly identify and diagnose issues when they occur.
If you're running Traxx behind an Nginx reverse proxy, make sure to update your Nginx configuration to forward the real client IP properly. This ensures that Traxx can log the original client IP instead of the reverse proxy IP (127.0.0.1).
In your Nginx configuration (typically found in /etc/nginx/nginx.conf or /etc/nginx/sites-available/default), make sure to include the following:
server {
listen 80;
# Forward the real client IP to the Express app
location / {
proxy_set_header X-Forwarded-For $remote_addr; # Pass the original client IP
proxy_set_header X-Real-IP $remote_addr; # Pass the original client IP
proxy_set_header Host $host; # Preserve the original Host header
proxy_pass http://your_backend_upstream; # Replace with your Express app URL
}
}
With this setup:
X-Forwarded-For header.Made with 💻 by boopathi-srb
CC-BY-NC-4.0
FAQs
Asynchronous route-level analytics for Express.js. Tracks latency, request data, and errors. Supports notifications via Teams, Slack, and Google Chat. MongoDB + BullMQ + Redis.
The npm package traxx receives a total of 19 weekly downloads. As such, traxx popularity was classified as not popular.
We found that traxx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.