npmpackage.info

Gathering detailed insights and metrics for aws-lambda

aws-lambda

1.0.7

MIT

JavaScript

493.62 kB

113,083,437 3.4

Installations

npm install aws-lambda

Score

54.2

Supply Chain

96.8

Quality

74.9

Maintenance

100

Vulnerability

98.9

License

Pull Requests

Open

3

Total

3

Closed

0

Issues

Open

6

Total

10

Closed

4

Releases

Unable to fetch releases

Developer

awspilot

Developer Guide

BETA

Module System

CommonJS

Min. Node Version

Typescript Support

No

Node Version

12.22.7

NPM Version

6.14.15 Statistics

22 Stars

209 Commits

9 Forks

3 Watching

1 Branches

1 Contributors

Updated on 16 Nov 2024

Bundle Size

3.71 MB

Minified

493.62 kB

Minified + Gzipped

Bundlephobia

Languages

JavaScript (95.96%)

Dockerfile (2.69%)

Shell (1.35%)

Total Downloads

Cumulative downloads

Total Downloads

113,083,437

Last day

-13.4%

159,312

Compared to previous day

Last week

1.9%

939,423

Compared to previous week

Last month

4.3%

3,899,967

Compared to previous month

Last year

37.3%

42,714,499

Compared to previous year

Daily Downloads

Weekly Downloads

Monthly Downloads

Yearly Downloads

Dependencies

aws-sdk js-yaml watchpack commander

Dev Dependencies

eslint mocha

Versions

cli-lambda-deploy

Command line tool deploy code to AWS Lambda.

Notes

Versions prior to 1.0.5 suffer from "Command Injection" vulnerability,
thanks snyk.io and Song Li of Johns Hopkins University for reporting.

Installation

npm install -g aws-lambda

WARN: upgrading to v1.0.0 will remove your function environment and layers if they are not defined in the config file

Config file

PATH must point to your code folder and is relative to the config file
PATH can be relative or absolute
If not set, Runtime defaults to nodejs10.x
If not set, FunctionName defaults to the name of the config file ("my-function" in this case)
You can use Ref to reference environment variables in the form of env.YOUR_ENVIRONMENT_NAME
lambda deploy <file.lambda> credentials needs permissions to CreateFunction, UpdateFunctionConfiguration and UpdateFunctionCode
lambda delete <file.lambda> credentials needs permissions to DeleteFunction
lambda invoke <file.lambda> credentials needs permissions to InvokeFunction

Sample JSON config


{
	"PATH": "./test-function",
	"AWS_KEY": { "Ref" : "env.AWS_ACCESS_KEY_ID" },,
	"AWS_SECRET": { "Ref" : "env.AWS_SECRET_ACCESS_KEY"},
	"AWS_REGION": "us-east-1",

	"FunctionName": "test-lambda",
	"Role": "your_amazon_role",
	"Runtime": "nodejs10.x",
	"Handler": "index.handler",
	"MemorySize": "128",
	"Timeout": "3",
	"Environment": {
		"Variables": {
			"Hello": "World",
		}
	},
	"Layers": [
		"arn:aws:lambda:eu-central-1:452980636694:layer:awspilot-dynamodb-2_0_0-beta:1"
	],
	"Tags": {
		"k1": "v1",
		"k2": "v2"
	},
	"Description": ""
}

Sample YAML config

# unlike json, comments are allowed in yaml, yey!
# remember to use spaces not tabs 😞
PATH: ./new-function
AWS_KEY:  !Ref "env.lambda_deploy_aws_key"
AWS_SECRET: !Ref "env.lambda_deploy_aws_secret"
AWS_REGION: "eu-central-1"

FunctionName: new-function-v12
Role: "arn:aws:iam::452980636694:role/CliLambdaDeploy-TestRole-1H89NZ845HHBK"
Runtime: "nodejs8.10"
Handler: "index.handler"
MemorySize: "128"
Timeout: "3"
Environment:
    Variables:
        Hello: "World"
Layers:
    - "arn:aws:lambda:eu-central-1:452980636694:layer:awspilot-dynamodb-2_0_0-beta:1"
Tags:
    k1: v1
    k2: v2
Description: ""

Deploy from Local to AWS Lambda

// if installed globally then
$ lambda deploy /path/to/my-function.lambda
$ lambda deploy ../configs/my-function.lambda

// if 'npm installed' without the -g then you must use the full path
$ node_modules/.bin/lambda /path/to/my-function.lambda

// you can also add it in your scripts section of your package.json scripts: { "deploy-func1": "lambda deploy ../config/func1.lambda" }
$ npm run deploy-func1

Watch config file

aws-lambda can also watch the config file and the code folder specified in the config.PATH for changes and re-reploy on change

$ lambda start ../configs/my-function.lambda

Stable Version

The latest stable version of the package.

Stable Version

1.0.7

CRITICAL

9.8/10

Summary

OS command injection in aws-lambda

Affected Versions

<= 1.0.4

Patched Versions

1.0.5

10

Binary-Artifacts

Determines if the project has generated executable (binary) artifacts in the source repository.

10

Dangerous-Workflow

Determines if the project's GitHub Action workflows avoid dangerous patterns.

10

Vulnerabilities

Determines if the project has open, known unfixed vulnerabilities.

10

License

Determines if the project has defined a license.

0

Maintained

Determines if the project is "actively maintained".

0

Code-Review

Determines if the project requires human code review before pull requests (aka merge requests) are merged.

0

Token-Permissions

Determines if the project's workflows follow the principle of least privilege.

0

SAST

Determines if the project uses static code analysis.

0

CII-Best-Practices

Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.

0

Security-Policy

Determines if the project has published a security policy.

0

Fuzzing

Determines if the project uses fuzzing.

0

Branch-Protection

Determines if the default and release branches are protected with GitHub's branch protection settings.

0

Pinned-Dependencies

Determines if the project has declared and pinned the dependencies of its build process.

Reason

dependency not pinned by hash detected -- score normalized to 0

Details

Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:61: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:62: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yml:80: update your workflow using https://app.stepsecurity.io/secureworkflow/awspilot/cli-lambda-deploy/test.yml/master?enable=pin
Warn: containerImage not pinned by hash: docker/nodejs10.x/Dockerfile:1: pin your Docker image by updating amazonlinux:2 to amazonlinux:2@sha256:256a092a1df6b2bfcf88aa38d8255a37adf65d62e9544c1047dc6803cbd220ee
Warn: containerImage not pinned by hash: docker/nodejs8.10/Dockerfile:1: pin your Docker image by updating amazonlinux:2 to amazonlinux:2@sha256:256a092a1df6b2bfcf88aa38d8255a37adf65d62e9544c1047dc6803cbd220ee
Warn: downloadThenRun not pinned by hash: docker/nodejs10.x/Dockerfile:5
Warn: npmCommand not pinned by hash: docker/nodejs10.x/Dockerfile:6
Warn: downloadThenRun not pinned by hash: docker/nodejs8.10/Dockerfile:5
Warn: npmCommand not pinned by hash: docker/nodejs8.10/Dockerfile:6
Warn: npmCommand not pinned by hash: .github/workflows/test.yml:42
Info: 0 out of 5 GitHub-owned GitHubAction dependencies pinned
Info: 0 out of 2 third-party GitHubAction dependencies pinned
Info: 0 out of 3 npmCommand dependencies pinned
Info: 0 out of 2 containerImage dependencies pinned
Info: 0 out of 2 downloadThenRun dependencies pinned

Score

3.4

/10

Last Scanned on 2024-11-25

The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.

Learn More