Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
@attila.danku/cold-start-tool
Advanced tools
Check your lambdas file size and optimize them to reduce cold start duration.
This tool is designed to analyze built AWS Lambdas. It can check the file size of the Lambdas and, if the build is not minified, it can identify the three most used/imported libraries in the Lambda function and also creates metrics about all of the Lambdas. If the size of the Lambda exceeds a specified threshold, a warning will be generated. Our default config is optimized for SST framework.
As you can see the larger lambda build size cause a longer cold start duration. Our mission is to reduce the cold start duration and one of the best practices if you reduce your lambda build size.
Lambda build size | Cold start duration |
---|---|
1 MB | 150 ms |
19.6 MB | 692 ms |
30.2 MB | 1716 ms |
52.8 MB | 2515 ms |
Here some examples how to optimize your lambda imports:
// Instead of const AWS = require('aws-sdk'), use:
const DynamoDB = require('aws-sdk/clients/dynamodb')
// Instead of const AWSXRay = require('aws-xray-sdk'), use:
const AWSXRay = require('aws-xray-sdk-core')
// Instead of const AWS = AWSXRay.captureAWS(require('aws-sdk')), use:
const dynamodb = new DynamoDB.DocumentClient()
AWSXRay.captureAWSClient(dynamodb.service)
Installation:
npm install @theapexlab/cold-start-tool --save-dev
Run:
npm run cst
Uninstall:
npm uninstall @theapexlab/cold-start-tool
Upon first run, it creates a cst-config.json
with the default settings for SST in the root of the project.
If the lambda is not minified on build time the imported node-modules are commented like this // node_modules/...
, so this app basically counts the occurrences of the same imports, and if the file size is over 20MB (can be changed in cst-config.json
) the developer gets a warning, and the three most used libs in the lambda.
The configuration file cst-config.json
can be found at the root of the project. Here you can change a few things:
buildPath
: default folder where the built lambdas are locatedsearchTerm
: the start of the node_module comments to findwarningThresholdMB
: the maximum acceptable size of the lambda in megabytesshowOnlyErrors
: show only the files that exceed the warning thresholdfilterByName
: searchfilter for filesdetailedReport
: gives you a detailed report and the endSearch for something specific in a lambda's name:
npm run cst --filterByName=get
Overwrite the warning threshold:
npm run cst --warningThresholdMB=30
To show only the files that exceed the warning threshold:
npm run cst --showOnlyErrors
To run a detailed report:
npm run cst --detailed-report
To see all available options:
npm run cst --help
FAQs
Check your lambdas file size and optimize them to reduce cold start duration.
We found that @attila.danku/cold-start-tool demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.