
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@ublend-npm/aws-lambda
Advanced tools
Deploy Lambda functions to AWS in seconds with [Serverless Components](https://github.com/serverless/components). Utilizes layers for dependency management and S3 accelerated uploads for maximum upload speeds.
Deploy Lambda functions to AWS in seconds with Serverless Components. Utilizes layers for dependency management and S3 accelerated uploads for maximum upload speeds.
$ npm install -g serverless
$ mkdir my-function && cd my-function
the directory should look something like this:
|- code
|- handler.js
|- package.json # optional
|- serverless.yml
|- .env # your AWS api keys
# .env
AWS_ACCESS_KEY_ID=XXX
AWS_SECRET_ACCESS_KEY=XXX
// handler.js
module.exports.hello = async (event, context, cb) => {
return { hello: 'world' }
}
# serverless.yml
myFunction:
component: "@serverless/aws-lambda"
inputs:
name: my-function
description: My Serverless Function
memory: 128
timeout: 20
code: ./code
handler: handler.hello
runtime: nodejs8.10
env:
TABLE_NAME: my-table
region: us-east-1
# if you'd like to include any shims
shims:
- ../shims/shim.js
# specifying an existing deployment bucket would optimise deployment speed
# by using accelerated multipart uploads and dependency management with layers
bucket: my-deployment-bucket
$ serverless
For a real world example of how this component could be used, take a look at how the socket component is using it.
Checkout the Serverless Components repo for more information.
FAQs
Deploy Lambda functions to AWS in seconds with [Serverless Components](https://github.com/serverless/components). Utilizes layers for dependency management and S3 accelerated uploads for maximum upload speeds.
We found that @ublend-npm/aws-lambda demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 14 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.