
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@allthings/aws-kms-thingy
Advanced tools
A wrapper/helper utility for encrypting/decrypting with AWS KMS
Convenience wrapper around the AWS Node.js SDK to simplify encrypting/decrypting secrets with the AWS KMS service. Suitable for use with AWS Lambda.
The module assumes that the Amazon SDK has access to AWS credentials that are able to access the KMS key used for encryption and decryption.
npm install aws-kms-thingy aws-sdk@^2
Encrypt with:
aws-kms-thingy encrypt
You'll be prompted for the string to encrypt.
Decrypt with:
aws-kms-thingy decrypt
You'll be prompted for the encrypted string to decrypt.
Safe to use within a Lambda handler. After cold-start, decrypted values are cached so subsequent invocations won't incur an AWS KMS API call:
const { decrypt } = require('aws-kms-thingy')
module.exports.myLambdaHandler = (event, context, callback) => {
decrypt(process.env.SOME_API_TOKEN) // Only incurs network call on cold-start
.then(doStuffWithDecryptedApiToken)
.then(resultOrWhatever => callback(null, resultOrWhatever))
.catch(callback)
}
Decrypt multiple values in parallel
import { decrypt } from 'aws-kms-thingy'
const [
decryptedApiToken1,
decryptedApiToken2,
decryptedDatabasePassword,
somethingElseSecret,
] = await decrypt([
process.env.API_TOKEN_1,
process.env.API_TOKEN_2,
process.env.DATABASE_PASSWORD,
process.env.SOMETHING_ELSE_SECRET,
])
Providing a non-base64 encoded value will skip en/decrypting with AWS KMS and just return the same value. This is useful in local development where you may not be necessary to have your secrets encrypted. This helps to avoid the need to write development environment exception code:
import { decrypt } from 'aws-kms-thingy'
process.env.DATABASE_PASSWORD = 'foobar'
const dbPassword = await decrypt(process.env.DATABASE_PASSWORD)
console.log(dbPassword) // "foobar"
An undefined
value is also OK. This does nothing and returns undefined. Useful when environment variables are unset in local development.
process.env.DATABASE_PASSWORD = undefined // e.g. not set in development
const dbPassword = await decrypt(process.env.DATABASE_PASSWORD)
console.log(dbPassword) // undefined
Alternatively, one can also disable en/decryption entirely with DISABLE_AWS_KMS_THINGY
environment variable:
import { decrypt } from 'aws-kms-thingy'
process.env.DISABLE_AWS_KMS_THINGY = 'true'
const token = await decrypt('aHR0cDovL2JpdC5seS8xVHFjd243')
console.log(token) // "aHR0cDovL2JpdC5seS8xVHFjd243"
Methods
interface InterfaceEncryptParameters {
readonly plaintext: string
readonly keyId: string
}
async function encrypt(
parameters:
| InterfaceEncryptParameters
| ReadonlyArray<InterfaceEncryptParameters>,
): Promise<string | ReadonlyArray<string>>
Encrypt a plaintext string. Requires a AWS KMS key ID (or key Arn).
const ciphertext = await encrypt({
plaintext: 'secret text',
keyId:
'arn:aws:kms:eu-west-1:000000000000:key/55kkmm11-aann-99ff-mmaa-3322115566hh',
})
AWS KMS encrypted ciphertext contains metadata so it is not necessary to provide context or key ID.
async function decrypt(
ciphertext: undefined | string | ReadonlyArray<string>,
): Promise<undefined | string | ReadonlyArray<string>>
Decrypt KMS-encrypted ciphertext.
const plaintext = await decrypt('aHR0cDovL2JpdC5seS8xVHFjd243')
aws-kms-thingy © Marco Lüthy. Released under the MIT license.
Authored and maintained by Marco Lüthy with help from contributors.
github.com/adieuadieu · GitHub @adieuadieu · Twitter @adieuadieu · Medium @marco.luethy
FAQs
A wrapper/helper utility for encrypting/decrypting with AWS KMS
We found that @allthings/aws-kms-thingy demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 4 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.