
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@nypl/node-lambda-boilerplate
Advanced tools
An AWS node-lambda boilerplate written in ES7 via Babel that includes various configuration, testing, and deployment scripts
A boilerplate (starter kit) for writing AWS Lambdas in Node using the node-lambda module. Supports ES7 syntax via babel and contains pre-configured NPM scripts found in package.json that enable you to run your lambda locally, test your code, package and deploy your lambda to AWS based of your aws-profile.
v1.0.0
Written in ES7 AWS Node Target - Node 6.10.3
./testNODE_ENV is set to production for AWS environmentsInstall all Node dependencies via NPM
$ npm install
Once all dependencies are installed, you want to run the following NPM commands included in the package.json configuration file to setup a local development environment.
.env file for the node-lambda moduleCopies the sample .env file under ./sample/.env.sample into ./.env
$ npm run setup:node-lambda-env
Once the .env file is copied, open the file and edit the following marked required:
AWS_REGION=us-east-1
AWS_FUNCTION_NAME=<FUNCTION NAME> (required in UpperCamelCase)
AWS_MEMORY_SIZE=128 (required)
AWS_TIMEOUT=30 (required)
AWS_DESCRIPTION=
AWS_RUNTIME=nodejs6.10 (set as default)
AWS_VPC_SUBNETS=
AWS_VPC_SECURITY_GROUPS=
AWS_TRACING_CONFIG=
EXCLUDE_GLOBS="event.json"
PACKAGE_DIRECTORY=build
Note: This ENV file is used by node-lambda to obtain your AWS basic configuration. AWS ARN_ROLE and PROFILES are handled by npm commands via --profile and --role
{environment}.env fileRunning the following NPM Commands will:
.env file as ./config/local.env used for local development$ npm run setup:local-env // Used in local development when running `npm run local-run`
.env file as ./config/development.env$ npm run setup:development-env
.env file as ./config/production.env$ npm run setup:production-env
These environment specific .env files will be used to set environment variables when deployed by the node-lambda module.
An example of the sample deployment environment *.env file:
OAUTH_PROVIDER_URL=XXX
OAUTH_PROVIDER_SCOPE=XXX
OAUTH_CLIENT_ID=XXX
OAUTH_CLIENT_SECRET=XXX
NODE_ENV=XXX // Use 'development' when developing locally via `npm run local-run`. If deploying to AWS use 'production', this will trigger the decryption client.
event_sources_{environment}.json fileThis file is used by the node-lambda module to deploy your Lambda with the correct mappings.
You must edit the file once created and add your specific EventSourceArn value, found in the AWS Console. If no mapping is necessary, update the file to an empty object {}.
Running the following NPM Commands will:
event_sources_development.json file in ./config/$ npm run setup:development-sources
event_sources_production.json file in ./config/$ npm run setup:production-sources
To develop and run your Lambda locally you must ensure to complete Step 1 and Step 2 of the Setup process.
REMINDER: Your ./config/local.env and ./.env environment variables MUST be configured in order for the next step to work.
Next, run the following NPM command to use the sample event found in ./sample/sample_event.json.
Exceutes
node lambda runpointing the the sample event.
$ npm run local-run // Code is transpiled into dist/ and node-lambda will use that as the target path
To deploy your Lambda function via the node-lambda module ensure you have completed all the steps of the Setup process and have added all configuration variables required.
The following NPM Commands will execute the node-lambda deploy command mapping configurations to the proper environments (qa & production). These commands can be modified in package.json.
Prior to the execution of any
npm deploy ...commands,npm run buildis executed to successfully transpile all ES7 code th Node 6.10.x
node-lambda deploy with DEVELOPMENT configurations$ npm run deploy:development
node-lambda deploy with PRODUCTION configurations$ npm run deploy:production
Istanbul is currently used in conjunction with Mocha to report coverage of all unit tests.
Simply run:
$ npm run coverage:report
Executing this NPM command will create a ./coverage/ folder with an interactive UI reporting the coverage analysis, now you can open up ./coverage/index.html in your browser to view an enhanced report.
Unit tests are written using Mocha, Chai and Sinon. All tests can be found under the ./test directory. Mocha configurations are set and can be modified in ./test/mocha.opts.
To run test, use the following NPM script found in
package.json.
$ npm run test // Will run all tests found in the ./test/ path, for excluded files see nyc->exclude in package.json
$ npm run test [filename].test.js // Will run a specific test for the given filename
This codebase currently uses Standard JS as the JavaScript linter.
To lint files use the following NPM command:
$ npm run lint // Will lint all files except those listed in package.json under standard->ignore
$ npm run lint [filename].js // Will lint the specific JS file
FAQs
An AWS node-lambda boilerplate written in ES7 via Babel that includes various configuration, testing, and deployment scripts
We found that @nypl/node-lambda-boilerplate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.