
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@cloudflare/wrangler
Advanced tools
wrangler
is a CLI tool designed for folks who are interested in using Cloudflare Workers.
You have many options to install wrangler!
npm
npm i @cloudflare/wrangler -g
In case you need to store/mirror binaries on premise you will need to specify where wrangler should search for them by providing any of the following:
WRANGLER_BINARY_HOST
wrangler_binary_host
cargo
cargo install wrangler
If you don't have cargo
or npm
installed, you will need to follow these additional instructions.
For information regarding updating Wrangler, click here.
Once you have installed Wrangler, spinning up and deploying your first Worker is easy!
$ wrangler generate my-worker
$ cd my-worker
# update your wrangler.toml with your Cloudflare Account ID
$ wrangler config
$ wrangler publish
generate
Scaffold a project, including boilerplate code for a Rust library and a Cloudflare Worker.
wrangler generate <name> <template> --type=["webpack", "javascript", "rust"]
All of the arguments and flags to this command are optional:
name
: defaults to worker
template
: defaults to the https://github.com/cloudflare/worker-template
type
: defaults to "webpack"init
Creates a skeleton wrangler.toml
in an existing directory. This can be used as an alternative to generate
if you prefer to clone a repository yourself.
wrangler init <name> --type=["webpack", "javascript", "rust"]
All of the arguments and flags to this command are optional:
name
: defaults to the name of your working directorytype
: defaults to "webpack".build
Build your project. This command looks at your wrangler.toml
file and runs the build steps associated
with the "type"
declared there.
Additionally, you can configure different environments.
config
Configure your global Cloudflare user. This is an interactive command that will prompt you for your API token:
wrangler config
Enter API token:
superlongapitoken
You can also provide your email and global API key (this is not recommended for security reasons):
wrangler config --api-key
Enter email:
testuser@example.com
Enter global API key:
superlongapikey
You can also use environment variables to configure these values.
publish
Publish your Worker to Cloudflare. Several keys in your wrangler.toml
determine whether you are publishing to a workers.dev subdomain or your own registered domain, proxied through Cloudflare.
Additionally, you can configure different environments.
You can also use environment variables to handle authentication when you publish a Worker.
# e.g.
CF_API_TOKEN=superlongtoken wrangler publish
# where
# $CF_API_TOKEN -> your Cloudflare API token
CF_API_KEY=superlongapikey CF_EMAIL=testuser@example.com wrangler publish
# where
# $CF_API_KEY -> your Cloudflare API key
# $CF_EMAIL -> your Cloudflare account email
kv
Interact with your Workers KV store. This is actually a whole suite of subcommands. Read more about in Wrangler KV Documentation.
dev
wrangler dev
works very similarly to wrangler preview
except that instead of opening your browser to preview your worker, it will start a server on localhost that will execute your worker on incoming HTTP requests. From there you can use cURL, Postman, your browser, or any other HTTP client to test the behavior of your worker before publishing it.
You should run wrangler dev from your worker directory, and if your worker makes any requests to a backend, you should specify the host with --host example.com
.
From here you should be able to send HTTP requests to localhost:8787
along with any headers and paths, and your worker should execute as expected. Additionally, you should see console.log messages and exceptions appearing in your terminal.
👂 Listening on http://localhost:8787
[2020-02-18 19:37:08] GET example.com/ HTTP/1.1 200 OK
All of the arguments and flags to this command are optional:
env
: environment to buildhost
: domain to test behind your worker. defaults to example.comip
: ip to listen on. defaults to localhostport
: port to listen on. defaults to 8787All information regarding wrangler or Cloudflare Workers is located in the Cloudflare Workers Developer Docs. This includes:
To learn about deploying static assets using wrangler
, see the Workers Sites Quickstart.
🎭 1.8.4
Don't remove user configuration on npm installs - EverlastingBugstopper, issue/1180 pull/1181
Wrangler started removing user's authentication configuration files on reinstallation from npm - this is no good and is fixed in this release.
Allow multiline files to be piped to wrangler secret put
- EverlastingBugstopper, issue/1132 pull/1171
Previously, if you tried to pipe a multiline file to wrangler secret put
, the secret would only upload the first line of the file. This... was not helpful - cat hello_world.txt | wrangler secret put
should behave as expected with this release.
Bump GitHub Actions checkout version - imbsky, pull/1170
GitHub Actions are pretty nifty, and we've started using them as our CI provider in Wrangler. Actions allow you to specify a step that "uses" a template, and one of the most used templates is the template that checks out relevant code. GitHub just released v2 of that template, and our CI now uses it!
FAQs
Command-line interface for all things Cloudflare Workers
We found that @cloudflare/wrangler demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.