Microsoft Application Insights SDK for Node.js
Installations
npm install applicationinsights
Developer
microsoft
Developer Guide
Module System
CommonJS
Min. Node Version
>=8.0.0
Typescript Support
Yes
Node Version
18.5.0
NPM Version
Statistics
325 Stars
959 Commits
140 Forks
96 Watching
5 Branches
81 Contributors
Updated on 25 Oct 2024
Languages
TypeScript (86.02%)
JavaScript (13.93%)
Shell (0.05%)
Total Downloads
Cumulative downloads
Total Downloads
110,840,694
Last day
2%
130,681
Compared to previous day
Last week
2.3%
670,084
Compared to previous week
Last month
9.1%
2,843,684
Compared to previous month
Last year
9.1%
30,926,941
Compared to previous year
Daily Downloads
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
24
Application Insights for Node.js
Application Insights SDK monitors your backend services and components after you deploy them to help you discover and rapidly diagnose performance and other issues. Add this SDK to your Node.js services to include deep info about Node.js processes and their external dependencies such as database and cache services. You can use this SDK for your Node.js services hosted anywhere: your datacenter, Azure VMs and Web Apps, and even other public clouds. This solution is based on OpenTelemetry, to learn more about OpenTelemetry concepts, see the OpenTelemetry overview or OpenTelemetry FAQ.
Supported Node.js versions
Important: The Azure Monitor OpenTelemetry-based Offerings for Node.js applications do not support older versions of Node that were supported by Application Insights 2.X SDK. If you rely on this support, please continue to use version 2.X.
We support the versions of Node.js that are supported by OpenTelemetry.
Limitations of Application Insights 3.X SDK
In order to support importing version 3.X SDK as an ESM module, please follow the OpenTelemetry project's documentation on using the instrumentation hook.
Consider whether this version is right for you. It enables distributed tracing, metrics, logs and excludes:
- Autopopulation of Cloud Role Name and Cloud Role Instance in Azure environments
- Autopopulation of User ID and Authenticated User ID when you use the Application Insights JavaScript SDK
- Autopopulation of User IP (to determine location attributes)
- Ability to override Operation Name
- Ability to manually set User ID or Authenticated User ID
- Propagating Operation Name to Dependency Telemetry
Warning: This SDK only works for Node.js environments. Use the Application Insights JavaScript SDK for web and browser scenarios.
To determine if this version of Application Insights is right for you, review the Application Insights 2.X SDK migration guide.
Prerequisites
-
Azure subscription: Create an Azure subscription for free
-
Application Insights resource: Create an Application Insights resource
-
Application using an officially supported version of Node.js runtime:
Get started
Important: On March 31st, 2025, support for instrumentation key ingestion will end. Instrumentation key ingestion will continue to work, but we’ll no longer provide updates or support for the feature. Transition to connection strings to take advantage of new capabilities.
- Create an Application Insights resource in Azure by following these instructions.
- Grab the Connection String from the resource you created in step 1. Later, you'll either add it to your app's environment variables or use it directly in your scripts.
- Add the Application Insights Node.js SDK to your app's dependencies and
package.json:
1npm install --save applicationinsights
Note: If you're using TypeScript, please install @types/node package to prevent build issues, this npm package contains built-in typings.
- As early as possible in your app's code, load the Application Insights
package:
1let appInsights = require('applicationinsights');
- Configure the local SDK by calling
appInsights.setup('YOUR_CONNECTION_STRING');
, using the connection string you grabbed in step 2. Or put it in theAPPLICATIONINSIGHTS_CONNECTION_STRING
environment variable and callappInsights.setup()
without parameters.For more configuration options see below.
- Finally, start automatically collecting and sending data by calling
appInsights.start();
.
- If the connection string is set in the environment variable
APPLICATIONINSIGHTS_CONNECTION_STRING,
.setup()
can be called with no arguments. This makes it easy to use different connection strings for different environments.
Load the Application Insights library (i.e. require("applicationinsights")
) as
early as possible in your scripts, before loading other packages. This is needed
so that the Application Insights library can prepare later packages for tracking.
If you encounter conflicts with other libraries doing similar preparation, try
loading the Application Insights library after those.
Configuration
The appInsights object provides a number of methods to setup SDK behavior. They are listed in the following snippet with their default values.
1let appInsights = require("applicationinsights"); 2appInsights.setup("<YOUR_CONNECTION_STRING>") 3 .setAutoCollectRequests(true) 4 .setAutoCollectPerformance(true, true) 5 .setAutoCollectExceptions(true) 6 .setAutoCollectDependencies(true) 7 .setAutoCollectConsole(true, false) 8 .setAutoCollectPreAggregatedMetrics(true) 9 .setSendLiveMetrics(false) 10 .setInternalLogging(false, true) 11 .enableWebInstrumentation(false) 12 .start();
Please review their descriptions in your IDE's built-in type hinting, or applicationinsights.ts for detailed information on what these control, and optional secondary arguments.
Note that by default setAutoCollectConsole
is configured to exclude calls to console.log
(and other console
methods). By default, only calls to supported third-party loggers
(e.g. winston
, bunyan
) will be collected. You can change this behavior to include calls
to console
methods by using setAutoCollectConsole(true, true)
.
Note that by default enableWebInstrumentation
will use the connection string for SDK initialization. If you want to use a different one, you can set it as enableWebInstrumentation(true, "your-connection-string")
.
The TelemetryClient object contains a config
property with many optional settings. These can be set as follows:
client.config.PROPERTYNAME = VALUE;
These properties are client specific, so you can configure appInsights.defaultClient
separately from clients created with new appInsights.TelemetryClient()
.
Property | Description |
---|---|
proxyHttpUrl | A proxy server for SDK HTTP traffic (Optional, Default pulled from http_proxy environment variable) |
proxyHttpsUrl | A proxy server for SDK HTTPS traffic (Optional, Default pulled from https_proxy environment variable) |
maxBatchIntervalMs | The maximum amount of time to wait to for a payload to reach maxBatchSize (Default 15000 ) |
samplingPercentage | The percentage of telemetry items tracked that should be transmitted (Default 100 ) |
enableAutoCollectExternalLoggers | Sets the state of console. If true logger activity will be sent to Application Insights |
enableAutoCollectConsole | Sets the state of logger tracking (enabled by default for third-party loggers only). If true, logger auto collection will include console.log calls (default false) |
enableAutoCollectExceptions | Sets the state of exception tracking (enabled by default). If true uncaught exceptions will be sent to Application Insights |
enableAutoCollectPerformance | Sets the state of performance tracking (enabled by default). If true performance counters will be collected every second and sent to Application Insights |
enableAutoCollectPreAggregatedMetrics | Sets the state of pre aggregated metrics tracking (enabled by default). If true pre aggregated metrics will be collected every minute and sent to Application Insights |
enableAutoCollectRequests | Sets the state of request tracking (enabled by default). If true requests will be sent to Application Insights |
enableAutoCollectDependencies | Sets the state of dependency tracking (enabled by default). If true dependencies will be sent to Application Insights |
enableUseDiskRetryCaching | If true events that occurred while client is offline will be cached on disk |
enableInternalDebugLogging | Enables debug and warning logging for AppInsights itself. If true, enables debug logging |
enableInternalWarningLogging | Enables debug and warning logging for AppInsights itself. If true, enables warning logging |
enableSendLiveMetrics | Enables communication with Application Insights Live Metrics. If true, enables communication with the live metrics service |
noDiagnosticChannel | In order to track context across asynchronous calls, some changes are required in third party libraries such as mongodb and redis. By default ApplicationInsights will use diagnostic-channel-publishers to monkey-patch some of these libraries. This property is to disable the feature. Note that by setting this flag, events may no longer be correctly associated with the right operation. |
noPatchModules | Disable individual monkey-patches. Set noPatchModules to a comma separated list of packages to disable. e.g. "noPatchModules": "console,redis" to avoid patching the console and redis packages. The following modules are available: azuresdk, bunyan, console, mongodb, mongodb-core, mysql, redis, winston, pg , and pg-pool . Visit the diagnostic-channel-publishers' README for information about exactly which versions of these packages are patched. |
aadTokenCredential | Azure Credential instance to be used to authenticate the App. AAD Identity Credential Classes |
enableWebInstrumentation | Sets the state of automatic web Instrumentation (Optional, disabled by default). If true, web instrumentation will be enabled on valid node server http response with the connection string used for SDK initialization |
webInstrumentationConnectionString | Sets connection string used for web Instrumentation (Optional, Default undefined) |
webInstrumentationSrc | Sets web Instrumentation CDN url (Optional). see more details at ApplicationInsights JavaScript SDK |
All these properties except aadTokenCredential could be configured using configuration file applicationinsights.json
located under root folder of applicationinsights package installation folder, Ex: node_modules/applicationinsights
. These configuration values will be applied to all TelemetryClients created in the SDK.
1{ 2 "samplingPercentage": 80, 3 "enableAutoCollectExternalLoggers": true, 4 "enableAutoCollectExceptions": true, 5 "enableSendLiveMetrics": true, 6 ... 7} 8
Custom JSON file could be provided using APPLICATIONINSIGHTS_CONFIGURATION_FILE
environment variable.
1process.env.APPLICATIONINSIGHTS_CONFIGURATION_FILE = "C:/applicationinsights/config/customConfig.json" 2 3// Application Insights SDK setup....
Alternatively, instead of using a configuration file, you can specify the entire content of the JSON configuration via the environment variable APPLICATIONINSIGHTS_CONFIGURATION_CONTENT
.
Sampling
By default, the SDK will send all collected data to the Application Insights service. If you collect a lot of data, you might want to enable sampling to reduce the amount of data sent. Set the samplingPercentage
field on the Config object of a Client to accomplish this. Setting samplingPercentage
to 100 (the default) means all data will be sent, and 0 means nothing will be sent.
If you are using automatic correlation, all data associated with a single request will be included or excluded as a unit.
Add code such as the following to enable sampling:
1const appInsights = require("applicationinsights"); 2appInsights.setup("<YOUR_CONNECTION_STRING>"); 3appInsights.defaultClient.config.samplingPercentage = 33; // 33% of all telemetry will be sent to Application Insights 4appInsights.start();
Automatic web Instrumentation
For node server with configuration enableWebInstrumentation
set to true
or environment variable APPLICATIONINSIGHTS_WEB_INSTRUMENTATION_ENABLED = true
, web Instrumentation will be enabled on node server response when all of the following requirements are met:
- Response has status code
200
. - Response method is
GET
. - Sever response has
Content-Type
html. - Server response must have both
<head>
and</head>
Tags. - If response is compressed, it must have only one
Content-Encoding
type, and encoding type must be one ofgzip
,br
ordeflate
. - Response does not contain current /backup web Instrumentation CDN endpoints. (current and backup Web Instrumentation CDN endpoints here)
web Instrumentation CDN endpoint can be changed by setting environment variable APPLICATIONINSIGHTS_WEB_INSTRUMENTATION_SOURCE = "web Instrumentation CDN endpoints"
.
web Instrumentation connection string can be changed by setting environment variable APPLICATIONINSIGHTS_WEB_INSTRUMENTATION_CONNECTION_STRING = "web Instrumentation connection string"
Note: web Instrumentation may slow down server response time, especially when response size is large or response is compressed. For the case in which some middle layers are applied, it may result in web Instrumentation not working and original response will be returned.
Automatic third-party instrumentation
If you require further third-party instrumenatations please use the Azure Monitor OpenTelemetry Distro to take advantage of OpenTelemetry. If you are an Application Insights 2.X SDK user, a migration guide is available.
In order to track context across asynchronous calls, some changes are required in third party libraries such as mongodb and redis.
By default ApplicationInsights will use the appropriate OpenTelemetry instrumentation for each library.
This can be disabled by setting the APPLICATION_INSIGHTS_NO_DIAGNOSTIC_CHANNEL
environment variable. Note that by setting that
environment variable, events may no longer be correctly associated with the right operation. Individual instrumentations can be
disabled by setting the APPLICATION_INSIGHTS_NO_PATCH_MODULES
environment variable to a comma separated list of packages to
disable, e.g. APPLICATION_INSIGHTS_NO_PATCH_MODULES=console,redis
to avoid patching the console
and redis
packages.
The following modules are available: azuresdk
, bunyan
, console
, mongodb
, mongodb-core
, mysql
, redis
, winston
,
pg
, and pg-pool
.
Automatic instrumentation for several Azure SDKs is also enabled. Javascript Azure SDKs
The bunyan
, winston
, and console
patches will generate Application Insights Trace events based on whether setAutoCollectConsole
is enabled.
The rest will generate Application Insights Dependency events based on whether setAutoCollectDependencies
is enabled. Make sure that applicationinsights
is imported before any 3rd-party packages for them to be instrumented successfully.
Live Metrics
To enable sending live metrics of your app to Azure, use setSendLiveMetrics(true)
. Filtering of live metrics in the Portal is currently not supported.
Track custom telemetry
You can track any request, event, metric or exception using the Application Insights client. Examples follow:
1let appInsights = require("applicationinsights"); 2appInsights.setup().start(); // assuming connection string is in environment variables. start() can be omitted to disable any non-custom data 3let client = appInsights.defaultClient; 4client.trackEvent({name: "my custom event", properties: {customProperty: "custom property value"}}); 5client.trackException({exception: new Error("handled exceptions can be logged with this method")}); 6client.trackMetric({name: "custom metric", value: 3}); 7client.trackTrace({message: "trace message"}); 8client.trackDependency({target:"http://dbname", name:"select customers proc", data:"SELECT * FROM Customers", duration:231, resultCode:0, success: true, dependencyTypeName: "ZSQL"}); 9client.trackRequest({name:"GET /customers", url:"http://myserver/customers", duration:309, resultCode:200, success:true}); 10client.trackAvailability({id: "123456789abcdefghijklmnopqrstuvw", name: "availalaibility-test-name", duration: 1000, success: true, runLocation: "Japan East", message: "Passed"}) 11 12let http = require("http"); 13http.createServer( (req, res) => { 14 client.trackNodeHttpRequest({request: req, response: res}); // Place at the beginning of your request handler 15});
Note that custom properties are converted to their string representation before being sent, see Using properties for more information.
An example utility using trackMetric
to measure how long event loop scheduling takes:
1function startMeasuringEventLoop() { 2 var startTime = process.hrtime(); 3 var sampleSum = 0; 4 var sampleCount = 0; 5 6 // Measure event loop scheduling delay 7 setInterval(() => { 8 var elapsed = process.hrtime(startTime); 9 startTime = process.hrtime(); 10 sampleSum += elapsed[0] * 1e9 + elapsed[1]; 11 sampleCount++; 12 }, 0); 13 14 // Report custom metric every second 15 setInterval(() => { 16 var samples = sampleSum; 17 var count = sampleCount; 18 sampleSum = 0; 19 sampleCount = 0; 20 21 if (count > 0) { 22 var avgNs = samples / count; 23 var avgMs = Math.round(avgNs / 1e6); 24 client.trackMetric({name: "Event Loop Delay", value: avgMs}); 25 } 26 }, 1000); 27}
Self-diagnostics
"Self-diagnostics" refers to internal logging from Application Insights Node.js SDK.
This functionality can be helpful for spotting and diagnosing issues with Application Insights itself.
By default, Application Insights Node.js SDK logs at warning level to console, following code demonstrate how to enable debug logging as well and generate telemetry for internal logs:
1let appInsights = require("applicationinsights"); 2appInsights.setup("<YOUR_CONNECTION_STRING>") 3 .setInternalLogging(true, true) // Enable both debug and warning logging 4 .setAutoCollectConsole(true, true) // Generate Trace telemetry for winston/bunyan and console logs 5 .start();
Debug Logs could be enabled as well using APPLICATION_INSIGHTS_ENABLE_DEBUG_LOGS environment variable, and APPLICATION_INSIGHTS_DISABLE_WARNING_LOGS environment variable to disable warnings. Logs could be put into local file using APPLICATIONINSIGHTS_LOG_DESTINATION
environment variable, supported values are file
and file+console
, a file named applicationinsights.log
will be generated on tmp folder by default, including all logs, /tmp
for *nix and USERDIR/AppData/Local/Temp
for Windows. Log directory could be configured using APPLICATIONINSIGHTS_LOGDIR
environment variable.
1process.env.APPLICATIONINSIGHTS_LOG_DESTINATION = "file"; 2process.env.APPLICATIONINSIGHTS_LOGDIR = "C:/applicationinsights/logs" 3 4// Application Insights SDK setup....
ApplicationInsights 3.X SDK Unsupported Properties
Application Insights 3.X SDK will provide support path for customers who only require basic instrumentation as opposed to migrating to Azure Monitor OpenTelemetry. If unsupported methods are called, they are not breaking and your application will still run. Calling these unsupported methods will throw a warning that the method is not supported.
The following methods are called after using the below method.
1let applicationinsights = require("applicationinsights"); 2appinsights.setup("<YOUR_CONNECTION_STRING>").start();
And invoked via appInsights.<METHOD_NAME>
Property | Support Status |
---|---|
setDistributedTracingMode | AI only tracing mode is no longer supported. Migrate to using W3C_AND_AI tracing mode. |
setAutoCollectHeartbeat | Heartbeat is not supported in either Azure Monitor OpenTelemetry or the Application Insights 3.X SDK. |
setAutoDependencyCorrelation | Turning off autoDependencyCorrelation is not supported by either Azure Monitor OpenTelemetry or the Application Insights 3.X SDK. |
setUseDiskRetryCaching | While enabling/disabling offline storage is supported, setting the resend interval or the maxBytesOnDisk values are not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
setAutoCollectIncomingRequestAzureFunctions | Auto collection of Azure Functions is not supported by the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
The following configurations are set using either environment variables, setting them in the applicationinsights.json
file or by calling appInsights.defaultClient.config.<CONFIG_SETTING_VALUE>;
.
Property | Support Status |
---|---|
instrumentationKey & endpointUrl | Not supported by the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. Please migrate to using the connectionString. |
maxBatchSize | Not supported by the Application Insights 3.X SDK but can be configured by using OpenTelemetry SpanProcessors in Azure Monitor OpenTelemetry. |
disableAppInsights | Not supported by the Application Insights 3.X SDK. Disabling telemetry export is possible via Azure Monitor OpenTelemetry using OpenTelemetry. |
correlationIdRetryIntervalMs | Not supported by either the Application Insights 3.X SDK or Azure Monitor OpenTelemetry as correlation ID is deprecated. |
ignoreLegacyHeaders | Legacy headers in outgoing requests are not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. Therefore they will always be disabled. |
distributedTracingMode | Distributed tracing mode is always set to AI_AND_W3C. AI only tracing mode is not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
enableLoggerErrorToTrace | Not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry as all errors will be logged as exceptions in both. |
enableAutoCollectHeartbeat | Heartbeat is not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry as it is deprecated. |
enableAutoDependencyCorrelation | Cannot disable dependency correlation in either the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. Dependency correlation will always be enabled and therefore this setting is always true. |
enableAutoCollectIncomingRequestAzureFunctions | Auto collection of Azure Functions is not supported by the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
enableUseAsyncHooks | Using async hooks is not supported by the Application Insights 3.X SDK or Azure Monitor OpenTelemetry as it is not supported by OpenTelemetry. |
enableResendInterval | Not supported by the Application Insights 3.X SDK. It is possible to configure the interval between exports via OpenTelemetry span processors, but not specifically cached events. The @azure/monitor-opentelemetry-exporter uses a resend interval of one minute. |
enableMaxBytesOnDisk | Not supported by the Application Insights 3.X SDK. And not supported to be changed in Azure Monitor OpenTelemetry. The @azure/monitor-opentelemetry-exporter sets this value at 50MB. |
noHttpAgentKeepAlive | Not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
httpAgent/httpsAgent | Not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
webInstrumentationConfig | Not currently supported by the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
quickPulseHost | Not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
enableAutoCollectExtendedMetrics | Extended/native metrics are not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
disableAllExtendedMetrics | Will not have any effect as extended/native metrics are not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
extendedMetricDisablers | Will not have any effect as extended/native metrics are not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
correlationHeaderExcludedDomains | Not supported in the Application Insights 3.X SDK or Azure Monitor OpenTelemetry. |
The following methods are part of the TelemetryClient
class. They can be called using applicationinsights.defaultClient.<METHOD_NAME>()
.
Property | Support Status |
---|---|
trackPageView | PageViewTelemetry requires an id and a name field now instead of only an optional name field. |
track | Tracking generic telemetry is not longer supported. Please use one of the other manual track methods to track a specific telemetry type. |
getAuthorizationHandler | Not supported in the Application Insights 3.X SDK. |
addTelemetryProcessor | TelemetryProcessors are not supported in the Application Insights 3.X SDK. Please migrate to Azure Monitor OpenTelemetry and use OpenTelemetry Span Processors. |
clearTelemetryProcessors | TelemetryProcessors are not supported in the Application Insights 3.X SDK. Please migrate to Azure Monitor OpenTelemetry and use OpenTelemetry Span Processors. |
runTelemetryProcessors | TelemetryProcessors are not supported in the Application Insights 3.X SDK. Please migrate to Azure Monitor OpenTelemetry and use OpenTelemetry Span Processors. |
trackNodeHttpRequestSync | Not supported. Please use the trackRequest method instead. |
trackNodeHttpRequest | Not supported. Please use the trackRequest method instead. |
trackNodeHttpDependency | Not supported. Please use the trackDependency method instead. |
APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL
environment varialbe could be used to set desired log level, supporting the following values: NONE
, ERROR
, WARN
, INFO
, DEBUG
, VERBOSE
and ALL
.
Logs could be put into local file using APPLICATIONINSIGHTS_LOG_DESTINATION
environment variable, supported values are file
and file+console
, a file named applicationinsights.log
will be generated on tmp folder by default, including all logs, /tmp
for *nix and USERDIR/AppData/Local/Temp
for Windows. Log directory could be configured using APPLICATIONINSIGHTS_LOGDIR
environment variable.
1process.env.APPLICATIONINSIGHTS_INSTRUMENTATION_LOGGING_LEVEL = "VERBOSE"; 2process.env.APPLICATIONINSIGHTS_LOG_DESTINATION = "file"; 3process.env.APPLICATIONINSIGHTS_LOGDIR = "C:/applicationinsights/logs"; 4 5// Application Insights SDK setup....
Support
For help and questions about using this project, please create a Support request issue on https://github.com/microsoft/ApplicationInsights-node.js/issues.
For OpenTelemetry issues, contact the OpenTelemetry JavaScript community directly. Support Policy
Contributing
This project welcomes contributions and suggestions. Most contributions require you to agree to a Contributor License Agreement (CLA) declaring that you have the right to, and actually do, grant us the rights to use your contribution. For details, visit https://cla.microsoft.com.
When you submit a pull request, a CLA-bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., label, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repositories using our CLA.
This project has adopted the Microsoft Open Source Code of Conduct. For more information see the Code of Conduct FAQ or contact opencode@microsoft.com with any additional questions or comments.
Data Collection
As this SDK is designed to enable applications to perform data collection which is sent to the Microsoft collection endpoints the following is required to identify our privacy statement.
The software may collect information about you and your use of the software and send it to Microsoft. Microsoft may use this information to provide services and improve our products and services. You may turn off the telemetry as described in the repository. There are also some features in the software that may enable you and Microsoft to collect data from users of your applications. If you use these features, you must comply with applicable law, including providing appropriate notices to users of your applications together with a copy of Microsoft’s privacy statement. Our privacy statement is located at https://go.microsoft.com/fwlink/?LinkID=824704. You can learn more about data collection and use in the help documentation and our privacy statement. Your use of the software operates as your consent to these practices.
Trademarks
This project may contain trademarks or logos for projects, products, or services. Authorized use of Microsoft trademarks or logos is subject to and must follow Microsoft’s Trademark & Brand Guidelines. Use of Microsoft trademarks or logos in modified versions of this project must not cause confusion or imply Microsoft sponsorship. Any use of third-party trademarks or logos are subject to those third-party’s policies.
License
No vulnerabilities found.
Reason
9 commit(s) out of 30 and 15 issue activity out of 30 found in the last 90 days -- score normalized to 10
Reason
all last 30 commits are reviewed through GitHub
Reason
no vulnerabilities detected
Reason
no dangerous workflow patterns detected
Reason
security policy file detected
Details
- Info: security policy detected in current repo: SECURITY.md:1
Reason
no binaries found in the repo
Reason
license file detected
Details
- Info: : LICENSE:1
Reason
update tool detected
Details
- Info: Dependabot detected
Reason
dependency not pinned by hash detected -- score normalized to 9
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/backcompat.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/backcompat.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/backcompat.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/backcompat.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:46: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:58: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/codeql-analysis.yml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/integration.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/integration.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/integration.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/node.js.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/node.js.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/npm-publish.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/npm-publish.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/test.yml/master?enable=pin
- Warn: npmCommand not pinned by hash: .github/workflows/node.js.yml:24
- Info: Third-party GitHubActions are pinned
- Info: Dockerfile dependencies are pinned
- Info: no insecure (not pinned by hash) dependency downloads found in Dockerfiles
- Info: no insecure (not pinned by hash) dependency downloads found in shell scripts
Reason
branch protection is not maximal on development and all release branches
Details
- Info: 'force pushes' disabled on branch 'develop'
- Info: 'allow deletion' disabled on branch 'develop'
- Info: status check found to merge onto on branch 'develop'
- Warn: number of required reviewers is only 1 on branch 'develop'
- Info: 'force pushes' disabled on branch 'beta'
- Info: 'allow deletion' disabled on branch 'beta'
- Info: status check found to merge onto on branch 'beta'
- Warn: number of required reviewers is only 1 on branch 'beta'
Reason
no badge detected
Reason
non read-only tokens detected in GitHub workflows
Details
- Warn: no topLevel permission defined: .github/workflows/backcompat.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/backcompat.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/codeql-analysis.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=permissions
- Info: jobLevel 'actions' permission set to 'read': .github/workflows/codeql-analysis.yml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=permissions
- Info: jobLevel 'contents' permission set to 'read': .github/workflows/codeql-analysis.yml:29: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/codeql-analysis.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/integration.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/integration.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/node.js.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/node.js.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/npm-publish.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/npm-publish.yml/master?enable=permissions
- Warn: no topLevel permission defined: .github/workflows/test.yml:1: update your workflow using https://app.stepsecurity.io/secureworkflow/liuyuchenzh/webpack-upload-plugin/test.yml/master?enable=permissions
Reason
project is not fuzzed
Score
7.9
/10
Last Scanned on 2022-08-15
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn MoreOther packages similar to applicationinsights
@types/applicationinsights-js
TypeScript definitions for ApplicationInsights-JS
@0dep/pino-applicationinsights
Pino applicationinsights transport
@kth/appinsights
Wrapper module for applicationinsights
@microsoft/applicationinsights-web
Microsoft Application Insights JavaScript SDK - Web