
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@munter/netlify-lambda
Advanced tools
This is a small CLI tool that helps with building or serving lambdas built with a simple webpack/babel setup.
The goal is to make it easy to work with Lambda's with modern ES6 without being dependent on having the most state of the art node runtime available in the final deployment environment and with a build that can compile all modules into a single lambda file.
We recommend installing locally rather than globally: yarn add -D netlify-lambda
At the present moment you may have to also install peer dependencies as documented here - we will correct this for the next release when we update our webpack and babel versions.
Netlify lambda installs two commands:
netlify-lambda serve <folder>
netlify-lambda build <folder>
Both depends on a netlify.toml file being present in your project and configuring functions for deployment.
The serve function will start a dev server and a file watcher for the specified folder and route requests to the relevant function at:
http://localhost:9000/hello -> folder/hello.js (must export a handler(event, context callback) function)
The build function will run a single build of the functions in the folder.
When your function is deployed on Netlify, it will be available at /.netlify/functions/function-name for any given deploy context. It is advantageous to proxy the netlify-lambda serve development server to the same path on your primary development server.
Say you are running webpack-serve on port 8080 and netlify-lambda serve on port 9000. Mounting localhost:9000 to /.netlify/functions/ on your webpack-serve server (localhost:8080/.netlify/functions/) will closely replicate what the final production environment will look like during development, and will allow you to assume the same function url path in development and in production.
See netlify/create-react-app-lambda for an example of how to do this.
module.exports = {
mode: 'development',
devServer: {
proxy: {
"/.netlify": {
target: "http://localhost:9000",
pathRewrite: {"^/.netlify/functions" : ""}
}
}
}
}
By default the webpack configuration uses babel-loader to load all js files. Any .babelrc in the directory netlify-lambda is run from will be respected. If no .babelrc is found, a few basic settings are used.
If you need to use additional webpack modules or loaders, you can specify an additional webpack config with the -c option when running either serve or build.
The additional webpack config will be merged into the default config via webpack-merge's merge.smart method.
FAQs
Build and serve lambda function with webpack compilation
We found that @munter/netlify-lambda demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.