
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
utils-deep-clone
Advanced tools
# utils-deep-clone
Deep clones any json datatype
## Installation
yarn add utils-deep-clone
npm install utils-deep-clone
## Motivation
utils-deep-clone is designed specifically for winstonJS but it can be used wheresoever required. WinstonJS have an open bug that if you pass Error data type nested inside Object or nested inside any other data type then because Error being enumerable it won’t get printed in logs. So to handle this here’s a workaround. Just call toJSON function before calling winston.log and pass the response object in it. An example for this is given at the bottom.
# Normal DeepCloning - THE NEED
const someError = new Error('Something wrong happened')
const someError2 = new Error('Something wrong happened again')
const someError3 = new Error('Something wrong happened again again')
someError3.someData = 'Some data'
someError3.isActive = true
var obj = {
someError,
nestedValue: {
someError2
},
arrayValue: ['value1' ,'value2', someError3]
}
console.log(JSON.parse(JSON.stringify(obj)))
Response:
{ someError: {},
nestedValue: { someError2: {} },
arrayValue: [ 'value1', 'value2', { someData: 'Some data', isActive: true } ] }
Error is not getting printed because of it’s enumerable property.
# Usage - THE SOLUTION
Now doing the same thing with utils-deep-clone
const { toJSON } = require('utils-deep-clone')
const someError = new Error('Something wrong happened')
const someError2 = new Error('Something wrong happened again')
const someError3 = new Error('Something wrong happened again again')
someError3.someData = 'Some data'
someError3.isActive = true
var obj = {
someError,
nestedValue: {
someError2
},
arrayValue: ['value1' ,'value2', someError3]
}
console.log(toJSON(obj))
Response:
{ someError:
{ message: 'Something wrong happened',
stack: 'Error: Something wrong happened\n at Object.<anonymous> (/Users/atishay/Documents/utils-error-deep-log/Untitled-1.js:3:19)\n at Module._compile (module.js:652:30)\n at Object.Module._extensions..js (module.js:663:10)\n at Module.load (module.js:565:32)\n at tryModuleLoad (module.js:505:12)\n at Function.Module._load (module.js:497:3)\n at Function.Module.runMain (module.js:693:10)\n at startup (bootstrap_node.js:188:16)\n at bootstrap_node.js:609:3' },
arrayValue:
[ 'value1',
'value2',
{ message: 'Something wrong happened again again',
stack: 'Error: Something wrong happened again again\n at Object.<anonymous> (/Users/atishay/Documents/utils-error-deep-log/Untitled-1.js:5:20)\n at Module._compile (module.js:652:30)\n at Object.Module._extensions..js (module.js:663:10)\n at Module.load (module.js:565:32)\n at tryModuleLoad (module.js:505:12)\n at Function.Module._load (module.js:497:3)\n at Function.Module.runMain (module.js:693:10)\n at startup (bootstrap_node.js:188:16)\n at bootstrap_node.js:609:3',
someData: 'Some data',
isActive: true } ],
nestedValue:
{ someError2:
{ message: 'Something wrong happened again',
stack: 'Error: Something wrong happened again\n at Object.<anonymous> (/Users/atishay/Documents/utils-error-deep-log/Untitled-1.js:4:20)\n at Module._compile (module.js:652:30)\n at Object.Module._extensions..js (module.js:663:10)\n at Module.load (module.js:565:32)\n at tryModuleLoad (module.js:505:12)\n at Function.Module._load (module.js:497:3)\n at Function.Module.runMain (module.js:693:10)\n at startup (bootstrap_node.js:188:16)\n at bootstrap_node.js:609:3' } } }
## Debugging
const { toJSON, debug } = require('utils-deep-clone')
// Simply Call this for getting debug logs
debug()
const someError = new Error('Something wrong happened')
console.log(toJSON(someError))
# Winston Bug
Here’s the example from winston 2.x but the same bug exists in winston 3.x also.
const winston = require('winston')
const winstonLogger = new (winston.Logger)({
transports: [
new (winston.transports.Console)()
]
})
const log = (message, payload) => {
return winstonLogger.log('info', message, payload)
}
const testObj = {
error: new Error('Nothing will happen')
}
log('Testing few bugs', testObj)
Response:
info: Testing few bugs
Now, we’ll be also using utils-deep-clone
const winston = require('winston')
const { toJSON } = require('utils-deep-clone')
const winstonLogger = new (winston.Logger)({
transports: [
new (winston.transports.Console)()
]
})
const log = (message, payload) => {
try {
payload = toJSON(payload)
return winstonLogger.log('info', message, payload)
} catch(error) {
console.error('some error occured while consoling')
}
}
const testObj = {
error: new Error('It should work')
}
log('Testing few bugs', testObj)
Response:
info: Testing few bugs message=It should work, stack=Error: It should work
at Object.<anonymous> (/Users/atishay/Desktop/utils-error-deep-log/logger.js:20:10)
at Module._compile (module.js:652:30)
at Object.Module._extensions..js (module.js:663:10)
at Module.load (module.js:565:32)
at tryModuleLoad (module.js:505:12)
at Function.Module._load (module.js:497:3)
at Function.Module.runMain (module.js:693:10)
at startup (bootstrap_node.js:188:16)
at bootstrap_node.js:609:3
FAQs
Deep clones any json datatype
The npm package utils-deep-clone receives a total of 159 weekly downloads. As such, utils-deep-clone popularity was classified as not popular.
We found that utils-deep-clone demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.