Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@erdii/caddy-serverless-express
Advanced tools
A Node.js module that enables [aws-serverless-express](https://github.com/awslabs/aws-serverless-express) to work with [erdii/caddy-awslambda](https://github.com/erdii/caddy-awslambda/)
A Node.js module that enables aws-serverless-express to work with erdii/caddy-awslambda
npm install @erdii/caddy-serverless-express --save
yarn add @erdii/caddy-serverless-express
// index.js
const {
transformEvent,
transformContext,
} = require('@erdii/caddy-serverless-express');
const awsServerlessExpress = require("aws-serverless-express");
const app = require("./app");
const server = awsServerlessExpress.createServer(app);
exports.handle = (event, context, callback) => {
try {
return awsServerlessExpress.proxy(server, transformEvent(event), transformContext(context));
} catch (err) {
context.succeed({
error: {
_err: err,
name: err.name,
message: err.message,
},
});
return;
}
}
// app.js
const express = require("express");
const awsServerlessExpressMiddleware = require('aws-serverless-express/middleware')
const app = express();
app.set("trust proxy", true);
app.use(awsServerlessExpressMiddleware.eventContext())
app.get("/api", (req, res) => {
res.json({
path: req.path,
query: req.query,
ip: req.ip,
hello: "world",
});
});
module.exports = app;
curl -s http://localhost:8080/api/\?hi\=there
Output should be '{"path":"/api/","query":{"hi":"there"},"ip":"::1","hello":"world"}
// index.ts
import {
transformContext,
transformEvent,
} from "@erdii/caddy-serverless-express";
import awsServerlessExpress from "aws-serverless-express";
import { app } from "./app";
const server = awsServerlessExpress.createServer(app);
export const handle = (event: any, context: any, callback: any) => {
try {
return awsServerlessExpress.proxy(
server,
transformEvent(event),
transformContext(context) as any
);
} catch (err) {
context.succeed({
error: {
_err: err,
name: err.name,
message: err.message,
},
});
return;
}
}
// app.ts
import express from "express";
import * as awsServerlessExpressMiddleware from "aws-serverless-express/middleware";
export const app = express();
app.set("trust proxy", true);
app.use(awsServerlessExpressMiddleware.eventContext())
app.get("/api/hello", (req, res) => {
res.send("world");
});
app.get("/api/ping", (req, res) => {
res.send("pong");
});
curl -s http://localhost:8080/api/hello
Output should be 'world'
curl -s http://localhost:8080/api/ping
Output should be 'pong'
npm run test
http://localhost:8080 {
gzip
awslambda /api/ {
aws_region eu-central-1
aws_access <YOUR_AWS_ACCESS_KEY>
aws_secret <YOUE_AWS_SECRET_KEY>
single <YOUR-LAMBDA-FUNCTION-NAME>
header_upstream X-Forwarded-For {remote}
header_upstream X-Forwarded-Host {hostonly}
header_upstream X-Forwarded-Proto {scheme}
}
}
FAQs
A Node.js module that enables [aws-serverless-express](https://github.com/awslabs/aws-serverless-express) to work with [erdii/caddy-awslambda](https://github.com/erdii/caddy-awslambda/)
The npm package @erdii/caddy-serverless-express receives a total of 2 weekly downloads. As such, @erdii/caddy-serverless-express popularity was classified as not popular.
We found that @erdii/caddy-serverless-express demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.