
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Another Node.js logging module. For now this wraps Winston and provides a preconfigured standardised logger for use in our microservices and other projects.
First, install anotherlog using npm:
npm i anotherlog
Then, require the package and use it like so:
const log = require('anotherlog')('MyService')
log.info('Hello World')
// '2017-06-12T16:16:09.222Z (MyService) [INFO] - Hello Small World'
anotherlog(name, options={level})Instantiate a logger. Requires a name (i.e the name of the service).
.debug(message, meta)Lowest level of logging. Hidden by default. Set log level to 'debug' to see these. Useful for development.
.info(message, meta)Standard log message. Output to stdout
.warn(message, meta)Non critical errors. Output to stderr
.error(message, meta)Critical errors. Output to stderr
.intercept(data)Debug print data and return. Useful for intercepting promise chains. Requires debug level to show.
Promise.resolve({one: 'one', two: 'two'})
.then(log.intercept) // {"one": "one", "two": "two"}
.then(data => data.two)
.then(log.intercept) // "two"
.then(data => {
// do something
})
.setLevel(level)Set the minimum log level to output. If NODE_ENV set to development defaults to debug. Otherwise defaults to info
NODE_ENV=development will change the output emitted by this library. In development mode a warning is printed to the screen and messages are logged in a human readable format. When running in production all messages are logged as machine readable JSON.
To report bugs or request features, submit issues here on GitHub, concrete-cc/anotherlog/issues. Pull requests are also welcome.
MIT
FAQs
Another Node.js logger. Wraps Winston.
We found that anotherlog demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.