
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@hyperdrive.bot/serverless-composer-plugin
Advanced tools
Serverless Framework plugin for dynamic configuration loading, transformation, and module-scoped deployments
A comprehensive Serverless Framework plugin that dynamically composes Serverless Framework services by loading configuration fragments from structured directories. Now includes module-scoped deployment functionality for deploying specific modules within your Serverless application.
deployModule command with shorthand options{service}-{module}-{stage} pattern# Install stable version
npm install @hyperdrive.bot/serverless-composer
# Or install alpha version (latest features)
npm install @hyperdrive.bot/serverless-composer@alpha
Add the plugin to your serverless.yml file:
plugins:
- '@hyperdrive.bot/serverless-composer'
cd packages/serverless/composer
npm run build
Configure the plugin in your serverless.yml:
custom:
composer:
modulesDir: serverless/modules # Default: serverless/modules (for module deployments)
# Optional category-specific configurations
functions:
directory: custom/functions # Custom directory (optional)
transformer: path/to/functions-transformer.js
resources:
directory: custom/resources # Custom directory (optional)
transformer: path/to/resources-transformer.js
stepFunctions:
directory: custom/stepFunctions # Custom directory (optional)
transformer: path/to/stepfunctions-transformer.js
For regular deployments, organize your configuration files under serverless/:
project/
├── serverless.yml
├── serverless/
│ ├── functions/
│ │ ├── users.yml
│ │ ├── orders.yml
│ │ └── notifications.yml
│ ├── resources/
│ │ ├── dynamodb.yml
│ │ ├── s3.yml
│ │ └── api-gateway.yml
│ ├── stepFunctions/
│ │ └── order-processing.yml
│ └── outputs/
│ └── api-endpoints.yml
For module-scoped deployments, organize modules under the configured modulesDir:
project/
├── serverless.yml
├── serverless/
│ └── modules/
│ ├── auth/
│ │ ├── functions/
│ │ │ ├── login.yml
│ │ │ └── register.yml
│ │ ├── resources/
│ │ │ └── user-table.yml
│ │ └── outputs/
│ │ └── auth-outputs.yml
│ ├── payment/
│ │ ├── functions/
│ │ │ ├── process-payment.yml
│ │ │ └── refund.yml
│ │ └── resources/
│ │ └── payment-queue.yml
│ └── notifications/
│ ├── functions/
│ │ └── send-notification.yml
│ └── stepFunctions/
│ └── notification-workflow.yml
For regular deployments that compose all configuration fragments:
serverless deploy
This will load and merge all configuration files from the structured directories.
Deploy only the auth module:
serverless deployModule --module auth
Or using the shorthand:
serverless deployModule -m auth
What happens during module deployment:
{originalService}-{module}-{stage} (e.g., my-service-auth-dev)serverless/modules/auth/serverless deploy to deploy the composed module[composer] prefixRemove only the auth module:
serverless removeModule --module auth
Or using the shorthand:
serverless removeModule -m auth
What happens during module removal:
{originalService}-{module}-{stage} (e.g., my-service-auth-dev)serverless/modules/auth/serverless remove to delete the composed module[composer] prefixTo deploy multiple modules, run the command for each module:
serverless deployModule -m auth
serverless deployModule -m payment
serverless deployModule -m notifications
To remove multiple modules, run the command for each module:
serverless removeModule -m auth
serverless removeModule -m payment
serverless removeModule -m notifications
The plugin supports the following configuration categories:
functions: Lambda function definitionsresources: CloudFormation resourcesstepFunctions: Step Functions state machineslambdaRoleStatements: IAM role statements for Lambda functionsoutputs: CloudFormation outputsuserRoleStatements: Custom user role statementsmodules: Module-specific configurationsEach category can be customized with:
directory: Custom path for the category files (defaults to serverless/{categoryName})transformer: Optional function to transform loaded data before mergingThe plugin supports multiple file formats in each category directory:
.yml, .yaml.json.js, .cjs, .mjs.ts# serverless/functions/users.yml
getUser:
handler: src/handlers/users.getUser
events:
- http:
path: /users/{id}
method: get
createUser:
handler: src/handlers/users.createUser
events:
- http:
path: /users
method: post
# serverless/resources/dynamodb.yml
UserTable:
Type: AWS::DynamoDB::Table
Properties:
TableName: ${self:service}-users-${opt:stage}
BillingMode: PAY_PER_REQUEST
AttributeDefinitions:
- AttributeName: userId
AttributeType: S
KeySchema:
- AttributeName: userId
KeyType: HASH
custom:
composer:
modulesDir: my-custom-modules-path
You can customize the directory path for each category:
custom:
composer:
functions:
directory: my-custom-functions-dir
resources:
directory: my-custom-resources-dir
stepFunctions:
directory: my-custom-stepfunctions-dir
outputs:
directory: my-custom-outputs-dir
Transformers allow you to modify configuration fragments before they're merged:
custom:
composer:
functions:
directory: custom/functions # Optional custom directory
transformer: ./transformers/functions.js
resources:
directory: custom/resources # Optional custom directory
transformer: ./transformers/resources.js
// transformers/functions.js
module.exports = (payload, serverless) => {
// Add environment variables to all functions
const functionsWithEnv = {}
for (const [name, config] of Object.entries(payload)) {
functionsWithEnv[name] = {
...config,
environment: {
...config.environment,
STAGE: serverless.service.provider.stage,
SERVICE_NAME: serverless.service.service
}
}
}
return functionsWithEnv
}
// transformers/resources.ts
import { ServerlessInstance } from 'serverless'
interface ResourceConfig {
[key: string]: any
}
export default (payload: ResourceConfig, serverless: ServerlessInstance): ResourceConfig => {
// Add common tags to all resources
const resourcesWithTags = {}
for (const [name, config] of Object.entries(payload)) {
if (config.Type && config.Properties) {
resourcesWithTags[name] = {
...config,
Properties: {
...config.Properties,
Tags: [
...(config.Properties.Tags || []),
{ Key: 'Service', Value: serverless.service.service },
{ Key: 'Stage', Value: serverless.service.provider.stage }
]
}
}
} else {
resourcesWithTags[name] = config
}
}
return resourcesWithTags
}
When you run deployModule --module myModule:
{service}-{module}-{stage}{modulesDir}/{module}/serverless deploypopulateObject for variable resolutionextendConfigurationThe plugin automatically detects your Serverless Framework version and uses the appropriate integration method.
Error: Module directory not found: /path/to/serverless/modules/myModule
Solution: Ensure the module directory exists and contains the expected category subdirectories.
Warning: Module directory not found: /path/to/serverless/modules/myModule
Proceeding with removal in case resources still exist in AWS...
Note: This is expected behavior for removeModule. The command will proceed with removal even if the local module directory doesn't exist, as the AWS resources may still need to be cleaned up.
Transformer error in 'functions': Cannot read property 'stage' of undefined
Solution: Check your transformer function - ensure it handles the serverless instance correctly and doesn't assume properties exist.
If variables aren't resolving correctly, ensure:
⚠️ Cannot trigger automatic removal. Please run 'serverless remove' manually.
Solution: The plugin couldn't access the Serverless plugin manager. Run serverless remove manually to complete the module removal.
If you were previously using serverless-module-composer-plugin:
Update plugin reference:
plugins:
# Remove these lines:
# - serverless-composer-plugin
# - serverless-module-composer-plugin
# Add this line:
- @hyperdrive.bot/serverless-composer
Update configuration:
custom:
# Change from 'moduleComposer' to 'composer'
composer:
modulesDir: serverless/modules
Commands work identically:
# Deploy commands (unchanged)
serverless deployModule -m myModule
# Remove commands (new functionality)
serverless removeModule -m myModule
All functionality preserved: No breaking changes to existing workflows
npm run build
npm test
npm run lint
npm run lint:fix
MIT
FAQs
Serverless Framework plugin for dynamic configuration loading, transformation, and module-scoped deployments
We found that @hyperdrive.bot/serverless-composer-plugin demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.