
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@eahefnawy/lego
Advanced tools
A core-agnostic implementation of Serverless Components (codenamed LEGO). The "core" in this repo is just a cli that runs the method/command you specified, from a serverless.js
and pass the options as inputs.
The goal of this repo is to quickly innovate on the concept of components and abstractions, and design the core along the way as the needs arise: fat components first, thin core second.
npm i -g @eahefnawy/lego
const deploy = async (inputs) => {
console.log('deploy running...')
return {}
}
const remove = async (inputs) => {
console.log('remove running...')
return {}
}
const hello = async (inputs) => {
console.log(`hello ${inputs.name}...`)
return {}
}
module.exports = { deploy, remove, hello }
lego deploy
lego remove
lego hello --name world
lego <OPERATION> <COMPONENT> {...inputs}
# example
lego deploy lambda --name hello --memory 512
Note: Check out the components & examples folder for real world working examples, as well as the poc
folder for some abstraction ideas.
example (master)$ lego deploy role
Status: Role Deployed
Name: lego
Service: lambda.amazonaws.com
ARN: arn:aws:iam::552750238291:role/lego
example (master)$
example (master)$ lego deploy lambda
Status: Lambda Deployed
Name: lego
Memory: 128
Timeout: 10
Runtime: nodejs8.10
Handler: handler.hello
ARN: arn:aws:lambda:us-east-1:552750238299:function:lego
example (master)$
.
./src/env.js
example (master)$ lego deploy website
Status: Website Deployed
URL: lego-ebd3.s3-website-us-east-1.amazonaws.com
example (master)$
example (master)$ lego deploy table
Status: Table Deployed
Name: lego
Key: id
example (master)$
example (master)$ lego deploy websockets
Status: WebSockets Deployed
Name: lego
ID: axvfuc9ql0
Stage: dev
Expression: $request.body.action
URL: wss://axvfuc9ql0.execute-api.us-east-1.amazonaws.com/dev/
Routes:
- $connect
- $disconnect
- $default
example (master)$
example (master)$ lego deploy socket
Status: Socket Deployed
URL: wss://axvfuc9ql0.execute-api.us-east-1.amazonaws.com/dev/
example (master)$
The Socket component has a custom connect command that connects you to a local or deployed socket.
Examples
// socket.js in cwd
// if you deployed you'll be connected
// to the remote websockets server
// if not, you'll be connected to a local server
lego connect socket
// or you can force a local connection
lego connect socket --local
// By default, you're connected to the default route
// but you can specify a specific route to connect to
lego connect --route message
// if your socket.js file in another directory
lego connect socket --code ./backend
realtimeApp (master)$ node ../../bin/lego deploy
Status: Realtime App Deployed
Socket URL: wss://39jpalv9u5.execute-api.us-east-1.amazonaws.com/dev/
Website URL: realtimeapp-dev-1hmjmr.s3-website-us-east-1.amazonaws.com
realtimeApp (master)$
The Realtime app component also exposes the Socket component connect
command. So you can connect exactly the same way.
Declaring composable components in a serverless.yml
file is the source of all the complexity we have in v2. To accomplish this we face two very complicated and challenging issues:
As soon as we ignore the serverless.yml
requirement and start to think about a serverless.js
file, the majority of the core is shrinked. Giving power to the developer to do anything, without any new concepts or learnings! So instead of perfecting a serverless.yml
implemnetation, we should instead provide them the tools/functions to easily and simply write deployment scripts. You can think of it as gulp for serverless infrastructure.
A component is just an npm package that contains deployment logic. Instead of enforcing a certain component core api, we should encourage best practices. For example, a component typically (but not required) has a deploy
and remove
functions. When we think of components as just npm packages, we can make full use of node.js and npm, just like plugins do in v1, helping us to iterate quickly and build a bigger community faster.
The more components we have in the registry, the more valuable the entire project is, and the easier it becomes to write more components. With enough low level components, eventually we could reach a point where you don't need to provide any inputs for high level components. For example lego deploy users
would deploy the users
component by deploying the apig, lambda code/config and dynamoDb schema required, and logs the http endpoints you need.
With that in mind, it becomes clear that the registry and the community is the framework!
Supporting serverless.js
instead of serverless.yml
breaks the barrier between a component consumer and a component producer, and instead we have a single component user. The experience for using a component, and developing a component would be exactly the same. We just need to simplify it as much as possible. Publishing a component is as simple as publishing an npm package.
Since each component is just an npm package, they should not log anything when used by another component. Instead, each component should return its outputs along with its children's outputs up to the top level component. The top level component then specifies which of all those outputs to log.
In other words, our great uniform cli experience is that you can easily define your own customized, clean and use case focused cli experience.
Ignoring serverless.yml
limits us to only the JS commnuity. However, if components really simplify deploying serverless infrastructure, and since components are just npm packages, then we should be able to easily use them to deploy a deployment engine that is http exposed. We can then write simple http client in each language we wanna support. So we'd have a lambda that deploys a lambda :), that is if supporting multiple languages is a string requirement.
FAQs
Lego Components
We found that @eahefnawy/lego demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.