
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
lambda-lib
Advanced tools
This library contains a set of decorators to apply to AWS Lambda function to help abstract the event source and eliminate boilerplate code
import { HandlerController, ApiGateway } from 'lambda-lib'
const errorMap = [
{
error: ReferenceError,
status: 400
},
{
error: Error,
status: 404
}
]
@HandlerController
class SampleLambdaHandler {
@ApiGateway({ statusCode: 200, cors: true })
helloHandler (event) {
return Promise.resolve({ hello: world })
}
@ApiGateway({ statusCode: 200, errorMap: errorMap })
failedHandler (event) {
return Promise.reject(new ReferenceError('I am a reference error'))
}
}
const handler = new SampleLambdaHandler()
export default handler.getHandlers()
HTTP/1.1 200 OK
Access-Control-Allow-Credentials: true
Access-Control-Allow-Methods: POST, GET, PUT, PATCH, DELETE, OPTIONS
Access-Control-Allow-Origin: *
Connection: keep-alive
Content-Type: application/json
Date: Tue, 29 Aug 2017 17:07:04 GMT
accept-ranges: bytes
cache-control: no-cache
content-length: 39
vary: origin,accept-encoding
{
"hello": "world"
}
HTTP/1.1 400 Bad Request
Connection: keep-alive
Content-Type: application/json
Date: Tue, 29 Aug 2017 17:08:00 GMT
cache-control: no-cache
content-length: 398
vary: accept-encoding
{
"error": {
"message": "I am a reference error",
"name": "ReferenceError",
"_stackTrace": [
"ReferenceError: I am a reference error",
"at SampleLambdaHandler.failedHandler (/.../src/resources/example/index.js:223:15)",
"at /.../node_modules/lambda-lib/lib/api-gateway.js:93:19",
"at process._tickDomainCallback (internal/process/next_tick.js:135:7)"
]
}
}
import { Plugins } from 'lambda-lib'
// Registering a custom error response plugin. This is applied globally.
ApiGateway.registerPlugin(new Plugins.ErrorResponse(err => {
return {
test: 'This is the error response body for all errors',
error: err.message
}
}))
HTTP/1.1 400 Bad Request
Connection: keep-alive
Content-Type: application/json
Date: Tue, 29 Aug 2017 17:08:00 GMT
cache-control: no-cache
content-length: 398
vary: accept-encoding
{
"test": "This is the error response body for all errors",
"error": "I am a reference error"
}
| Plugin | Description |
|---|---|
| cors | When true, a set of default CORS headers are added to the response. Such as: Access-Control-Allow-Origin, Access-Control-Allow-Credentials, Access-Control-Allow-Methods |
| statusCode | Default status code for the response. Any object resolved via a Promise in the handler, will get this status code. |
| errorMap | Mapping of error types to response codes for rejected promises. |
| errorResponse | Format the response of an error. |
| Hook | Description |
|---|---|
| INITIALIZE | Initialize is executed right at the beginning of the request, before any default plugins have been executed |
| PRE_EXECUTE | The pre execute hook is run right before the execution of handler code. |
| POST_EXECUTE | This hook, post execute, is run after the execution of the handler code. |
| ON_ERROR | When ever there is an error which results in a rejected promise, this hook is executed. |
| FINALLY | Final hook executed after the response has been sent to the client already. (Unable to manipulate response contents here) |
See built-in plugins for samples
FAQs
Decorators and tools for AWS Lambda
We found that lambda-lib demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.