Gathering detailed insights and metrics for @opentelemetry/plugin-express
Gathering detailed insights and metrics for @opentelemetry/plugin-express
OpenTelemetry instrumentation for JavaScript modules
Installations
npm install @opentelemetry/plugin-expressDeveloper Guide
BETA
Typescript
Yes
Module System
CommonJS
Min. Node Version
>=8.0.0
Node Version
14.8.0
NPM Version
lerna/3.22.1/node@v14.8.0+x64 (darwin)
Score
83.5
Supply Chain
98.1
Quality
79.3
Maintenance
100
Vulnerability
100
License
Releases
1,906
instrumentation-restify: v0.48.1
instrumentation-restify-v0.48.1
Updated on Jun 12, 2025
instrumentation-redis: v0.49.1
instrumentation-redis-v0.49.1
Updated on Jun 12, 2025
instrumentation-net: v0.46.1
instrumentation-net-v0.46.1
Updated on Jun 12, 2025
instrumentation-mongodb: v0.55.1
instrumentation-mongodb-v0.55.1
Updated on Jun 12, 2025
instrumentation-koa: v0.50.1
instrumentation-koa-v0.50.1
Updated on Jun 12, 2025
instrumentation-hapi: v0.49.0
instrumentation-hapi-v0.49.0
Updated on Jun 12, 2025
Languages
3
TypeScript
JavaScript
Shell
TypeScript (97.58%)
JavaScript (2.42%)
Shell (0.01%)
Developer
Download Statistics
Total Downloads
2,351,084
Last Day
182
Last Week
4,336
Last Month
16,910
Last Year
190,081
GitHub Statistics
Apache-2.0 License
805 Stars
2,357 Commits
584 Forks
16 Watchers
8 Branches
293 Contributors
Updated on Jul 02, 2025
Bundle Size
41.58 kB
Minified
10.27 kB
Minified + Gzipped
Maintainers
4
Package Meta Information
Latest Version
0.15.0
Package Id
@opentelemetry/plugin-express@0.15.0
Size
10.89 kB
NPM Version
lerna/3.22.1/node@v14.8.0+x64 (darwin)
Node Version
14.8.0
Published on
Apr 05, 2021
Total Downloads
Cumulative downloads
Total Downloads
2,351,084
Last Day
-41.3%
182
Compared to previous day
Last Week
-11.3%
4,336
Compared to previous week
Last Month
13.1%
16,910
Compared to previous month
Last Year
-25.1%
190,081
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
3
OpenTelemetry Express Instrumentation for Node.js
This module provides automatic instrumentation for express.
For automatic instrumentation see the @opentelemetry/node package.
Installation
1npm install --save @opentelemetry/plugin-express
Supported Versions
^4.0.0
Usage
OpenTelemetry Express Instrumentation allows the user to automatically collect trace data and export them to their backend of choice, to give observability to distributed systems.
To load a specific plugin (express in this case), specify it in the registerInstrumentations's configuration.
1const { NodeTracerProvider } = require('@opentelemetry/node');
2const { registerInstrumentations } = require('@opentelemetry/instrumentation');
3
4const provider = new NodeTracerProvider();
5provider.register();
6
7registerInstrumentations({
8 instrumentations: [
9 {
10 plugins: {
11 express: {
12 enabled: true,
13 // You may use a package name or absolute path to the file.
14 path: '@opentelemetry/plugin-express',
15 }
16 }
17 },
18 ],
19 tracerProvider: provider,
20});
21To load all the supported plugins, use below approach. Each plugin is only loaded when the module that it patches is loaded; in other words, there is no computational overhead for listing plugins for unused modules.
1const { NodeTracerProvider } = require('@opentelemetry/node'); 2const { registerInstrumentations } = require('@opentelemetry/instrumentation'); 3 4const provider = new NodeTracerProvider(); 5provider.register(); 6registerInstrumentations({ 7 tracerProvider: provider, 8});
See examples/express for a short example.
Caveats
Because of the way express works, it's hard to correctly compute the time taken by asynchronous middlewares and request handlers. For this reason, the time you'll see reported for asynchronous middlewares and request handlers will only represent the synchronous execution time, and not any asynchronous work.
Express Plugin Options
Express plugin has few options available to choose from. You can set the following:
| Options | Type | Description |
|---|---|---|
ignoreLayers | IgnoreMatcher[] | Express plugin will not trace all layers that match. |
ignoreLayersType | ExpressLayerType[] | Express plugin will ignore the layers that match based on their type. |
For reference, here are the three different layer type:
routeris the name ofexpress.Router()middlewarerequest_handleris the name for anything thats not a router or a middleware.
Useful links
- For more information on OpenTelemetry, visit: https://opentelemetry.io/
- For more about OpenTelemetry JavaScript: https://github.com/open-telemetry/opentelemetry-js
- For help or feedback on this project, join us in GitHub Discussions
License
Apache 2.0 - See LICENSE for more information.
No vulnerabilities found.
Reason
no dangerous workflow patterns detected
Reason
all changesets reviewed
Reason
30 commit(s) and 13 issue activity found in the last 90 days -- score normalized to 10
Reason
update tool detected
Details
- Info: detected update tool: RenovateBot: renovate.json:1
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0
Reason
security policy file detected
Details
- Info: security policy file detected: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found linked content: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found disclosure, vulnerability, and/or timelines in security policy: github.com/open-telemetry/.github/SECURITY.md:1
- Info: Found text in security policy: github.com/open-telemetry/.github/SECURITY.md:1
Reason
SAST tool is run on all commits
Details
- Info: SAST configuration detected: CodeQL
- Info: all commits (30) are checked with a SAST tool
Reason
30 out of 30 merged PRs checked by a CI test -- score normalized to 10
Reason
project has 42 contributing companies or organizations
Details
- Info: found contributions from: Dynatrace, MineWeb, Obsifight, VilledeMontreal, WinterTC55, X-Profiler, bloomberg, causely-oss, ccowmu, census-instrumentation, cisco, cisco-open, dynatrace, dynatrace-oss, dynatrace-oss-contrib, elastic, epsagon, focale, google, googleapis, googlers, grafanalabs, helios, honeycombio, mend, narval-opensource, nodejs, odigos, open-telemetry, opencensus-integrations, openprofiling, opentracing, protectai, reelevant-tech, sentry, snyk, splunk, splunk a cisco company, tc39, the-samoyeds, villedemontreal, w3c
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'allow deletion' disabled on branch 'main'
- Info: 'force pushes' disabled on branch 'main'
- Warn: 'branch protection settings apply to administrators' is disabled on branch 'main'
- Warn: required approving review count is 1 on branch 'main'
- Info: codeowner review is required on branch 'main'
- Info: status check found to merge onto on branch 'main'
- Info: PRs are required in order to make changes on branch 'main'
Reason
dependency not pinned by hash detected -- score normalized to 5
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/close-stale.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/close-stale.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:24: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/codeql-analysis.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/component-owners.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/component-owners.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/label-prs.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/label-prs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/label-prs.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/label-prs.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint.yml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/lint.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/peer-api.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/peer-api.yaml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/pr-title.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/pr-title.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please-validate.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please-validate.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:23: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/release-please.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.pr.yml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.pr.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:160: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:163: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-all-versions.yml:169: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/test-all-versions.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:214: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:217: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:223: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:232: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:173: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:176: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/unit-test.yml:182: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/unit-test.yml:196: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/unit-test.yml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-otel-deps.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/update-otel-deps.yaml/main?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/update-otel-deps.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/open-telemetry/opentelemetry-js-contrib/update-otel-deps.yaml/main?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/release-please-validate.yaml:20
- Warn: npmCommand not pinned by hash: .github/workflows/release-please.yml:53
- Warn: npmCommand not pinned by hash: .github/workflows/update-otel-deps.yaml:35
- Info: 4 out of 39 GitHub-owned GitHubAction dependencies pinned
- Info: 3 out of 7 third-party GitHubAction dependencies pinned
- Info: 10 out of 13 npmCommand dependencies pinned
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/label-prs.yml:9
- Warn: no topLevel permission defined: .github/workflows/close-stale.yml:1
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1
- Warn: no topLevel permission defined: .github/workflows/component-owners.yml:1
- Info: topLevel 'contents' permission set to 'read': .github/workflows/fossa.yml:9
- Warn: no topLevel permission defined: .github/workflows/label-prs.yml:1
- Warn: no topLevel permission defined: .github/workflows/lint.yml:1
- Info: topLevel permissions set to 'read-all': .github/workflows/ossf-scorecard.yml:11
- Warn: no topLevel permission defined: .github/workflows/peer-api.yaml:1
- Warn: no topLevel permission defined: .github/workflows/pr-title.yml:1
- Warn: no topLevel permission defined: .github/workflows/release-please-validate.yaml:1
- Warn: no topLevel permission defined: .github/workflows/release-please.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.pr.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.push.yml:1
- Warn: no topLevel permission defined: .github/workflows/test-all-versions.yml:1
- Warn: no topLevel permission defined: .github/workflows/unit-test.yml:1
- Warn: no topLevel permission defined: .github/workflows/update-otel-deps.yaml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
13 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-m5vv-6r4h-3vj9
- Warn: Project is vulnerable to: GHSA-cj7v-w2c7-cp7c
- Warn: Project is vulnerable to: GHSA-v6h2-p8h4-qcjw
- Warn: Project is vulnerable to: GHSA-rrr8-f88r-h8q6
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-44fp-w29j-9vj5
- Warn: Project is vulnerable to: GHSA-4pg4-qvpc-4q3h
- Warn: Project is vulnerable to: GHSA-g5hg-p3ph-g8qg
- Warn: Project is vulnerable to: GHSA-9wv6-86v2-598j
- Warn: Project is vulnerable to: GHSA-rhx6-c78j-4q9w
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-m6fv-jmcg-4jfg
- Warn: Project is vulnerable to: GHSA-8cj5-5rvv-wf4v
Score
7.1
/10
Last Scanned on 2025-07-02T21:47:05Z
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More