
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@bbc/sqs-extended
Advanced tools
Handles large SQS payloads by offloading message bodies to S3 automatically.
A lightweight wrapper around sqs-consumer and sqs-producer that extends the functionality of the libraries to enable handling large SQS payloads by offloading message bodies to S3 automatically.
Note: This package is currently in development and is not recommended for production use.
To install this package, simply enter the following command into your terminal (or the variant of whatever package manager you are using):
npm install @bbc/sqs-extended
Visit https://bbc.github.io/sqs-extended/ for the full API documentation.
By default the consumer will look for AWS credentials in the places specified by the AWS SDK. The simplest option is to export your credentials as environment variables:
export AWS_SECRET_ACCESS_KEY=...
export AWS_ACCESS_KEY_ID=...
If you need to specify your credentials manually, you can use a pre-configured instance of the SQS Client client.
The consumer will receive and delete messages from the SQS queue. Ensure sqs:ReceiveMessage, sqs:DeleteMessage, sqs:DeleteMessageBatch, sqs:ChangeMessageVisibility and sqs:ChangeMessageVisibilityBatch access is granted on the queue being consumed.
The producer will send messages to the SQS queue. Ensure sqs:SendMessage and sqs:SendMessageBatch access is granted on the queue being sent to.
And finally, the producer will upload messages to S3. Ensure s3:PutObject and s3:GetObject access is granted on the bucket being used.
import { SQSExtendedProducer } from "sqs-extended";
const producer = new SQSExtendedProducer({
queueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue",
s3Bucket: "my-large-payload-bucket",
});
await producer.send({
id: "my-message-id",
body: largePayloadObject,
});
You can also read the full API documentation for the SQS Producer library that's used here.
import { SQSExtendedConsumer } from "sqs-extended";
const consumer = new SQSExtendedConsumer({
queueUrl: "https://sqs.us-east-1.amazonaws.com/123456789012/my-queue",
s3Bucket: "my-large-payload-bucket",
handleMessage: async (message) => {
console.log("Payload:", message.body);
},
});
consumer.start();
You can also read the full API documentation for the SQS Consumer library that's used here.
We welcome and appreciate contributions for anyone who would like to take the time to fix a bug or implement a new feature.
But before you get started, please read the contributing guidelines and code of conduct.
SQS Extended is distributed under the Apache License, Version 2.0, see LICENSE for more information.
FAQs
Handles large SQS payloads by offloading message bodies to S3 automatically.
We found that @bbc/sqs-extended demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 19 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.