
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
@mrgrain/cdk-updown
Advanced tools
Self-executable CDK apps.

Ever tried to quickly demo some infrastructure code? You write your CDK app, then switch to the terminal for cdk deploy, then back again for cdk destroy. It's annoying. Sharing examples is even worse - people need the CDK CLI installed and configured just to try your code. CDK up/down fixes this by making your apps self-executable. Your code becomes the deployment tool. One command to deploy and clean up. Perfect for quick prototyping, live demos, and tutorials where you don't want setup friction getting in the way.
Install the package using your preferred package manager:
npm install @mrgrain/cdk-updown
yarn add @mrgrain/cdk-updown
pnpm add @mrgrain/cdk-updown
bun add @mrgrain/cdk-updown
Create an executable TypeScript file for your CDK app ./bin/my-app.ts using the updown() function.
import { updown } from "@mrgrain/cdk-updown";
import { App, Stack, aws_sns } from "aws-cdk-lib";
const cli = updown(async () => {
// Build your CDK app here
const app = new App();
const stack = new Stack(app);
new aws_sns.Topic(stack, "Topic");
return app.synth();
});
// Run the CLI
await cli.run();
Then execute as usual:
npx tsx ./bin/my-app.ts
Using a bundle that can produce single-file executables, it is easily possible to make your CDK app fully runtime independent. For example with Bun:
bun build ./bin/my-app.ts --compile --minify --outfile ./dist/my-app
Now you have a fully self-contained binary of your app:
./dist/my-app
You can also call up() and down() directly.
It gives you more control over when to deploy or destroy your infrastructure without relying on command-line arguments.
Both methods return deployment data and throw errors instead of exiting the process. They skip the selection dialog, but maintain the terminal output. You can use them to build a more customized CLI experience.
import { updown } from "@mrgrain/cdk-updown";
import { App, Stack, aws_sns } from "aws-cdk-lib";
declare const builder: AssemblyBuilder;
try {
// Create the updown cli
const cli = updown(builder);
// Up and get deployment result
const deployResult = await cli.up();
console.log(`Deployed ${deployResult.stacks.length} stacks`);
// Down and get destroy result
const destroyResult = await cli.down();
console.log(`Destroyed ${destroyResult.stacks.length} stacks`);
} catch (error) {
console.error('Operation failed:', error.message);
// Handle error as needed
}
FAQs
Self-executable CDK apps
We found that @mrgrain/cdk-updown demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.