
Research
/Security News
jscrambler npm Package Compromised in Supply Chain Attack
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.
@aws-sdk/token-providers
Advanced tools
A collection of all token providers. The token providers should be used when the authorization
type is going to be token based. For example, the bearer authorization type set using
httpBearerAuth trait in Smithy.
import { fromStatic } from "@aws-sdk/token-providers";
const token = { token: "TOKEN" };
const staticTokenProvider = fromStatic(token);
const staticToken = await staticTokenProvider(); // returns { token: "TOKEN" }
import { fromSso } from "@aws-sdk/token-providers";
// returns token from SSO token cache or ssoOidc.createToken() call.
const ssoToken = await fromSso();
import { fromEnvSigningName } from "@aws-sdk/token-providers";
// returns token from environment, where token's key is based on signing name.
const envSigningNameToken = await fromEnvSigningName({ signingName: "signing name" });
import { nodeProvider } from "@aws-sdk/token-providers";
// returns token from default providers.
const token = await nodeProvider();
This package contains a minimal copy of the SSO OIDC client, instead of relying on the full client, which would cause a circular dependency.
When regenerating the bundled version of the SSO OIDC client, run the esbuild.js script and then make the following changes:
CreateTokenCommand, the client, and this command's
associated Exceptions, it is possible to remove auth dependencies.package.json of token-providers.The 'aws-sdk' package is the official AWS SDK for JavaScript, which includes a wide range of services and features for interacting with AWS. It provides comprehensive support for AWS services, including token management, but it is a larger package compared to @aws-sdk/token-providers, which is more focused on token providers.
The 'aws-amplify' package is a JavaScript library for frontend and mobile developers building cloud-enabled applications. It includes support for authentication, including token management with Amazon Cognito. While it offers similar functionalities, it is more geared towards frontend development and user authentication flows.
The 'aws-cdk' package is the AWS Cloud Development Kit, which allows developers to define cloud infrastructure using code. It includes support for managing authentication and authorization tokens as part of infrastructure as code. However, it is primarily focused on infrastructure management rather than just token providers.
FAQs
A collection of token providers
The npm package @aws-sdk/token-providers receives a total of 67,272,969 weekly downloads. As such, @aws-sdk/token-providers popularity was classified as popular.
We found that @aws-sdk/token-providers demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A compromised jscrambler npm release added a malicious preinstall hook that runs hidden native binaries on Linux, macOS, and Windows.

Research
/Security News
A malicious .NET package is typosquatting the Braintree SDK to steal live payment card data, merchant API keys, and host secrets from production apps.

Security News
/Research
Compromised Injective SDK npm version 1.20.21 exfiltrates wallet private keys and mnemonics through fake telemetry functionality.