
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
@pubsweet/component-aws-s3
Advanced tools
In order to use this component, the following configuration needs to be added to a PubSweet application inside a section named pubsweet-component-aws-s3:
secretAccessKey: the AWS_S3_SECRET_KEY value from the app's .env fileaccessKeyId: the AWS_S3_ACCESS_KEY value from the app's .env fileregion: the AWS_S3_REGION value from the app's .env filebucket: the AWS_S3_BUCKET value from the app's .env fileFor example:
"pubsweet-component-aws-s3": {
"secretAccessKey": "process.env.AWS_S3_SECRET_KEY",
"accessKeyId": "process.env.AWS_S3_ACCESS_KEY",
"region": "process.env.AWS_S3_REGION",
"bucket": "process.env.AWS_S3_BUCKET",
"validations": "path.resolve(__dirname, 'upload-validations.js')",
},
The .env file should look like this:
AWS_S3_ACCESS_KEY = exampleKey
AWS_S3_SECRET_KEY = exampleKey/sads/21
AWS_S3_REGION = region-name
AWS_S3_BUCKET = bucket-name
Then, as soon as possible in your app you should add the dotenv package:
require('dotenv').config()
component-aws-s3 APIA list of endpoints that help you upload, download and delete S3 files.
POST /api/file
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryWfPNVh4wuWBlyEyQ
------WebKitFormBoundaryWfPNVh4wuWBlyEyQ
Content-Disposition: form-data; name="fileType"
supplementary
------WebKitFormBoundaryWfPNVh4wuWBlyEyQ
Content-Disposition: form-data; name="fragmentId"
545
------WebKitFormBoundaryWfPNVh4wuWBlyEyQ
Content-Disposition: form-data; name="file"; filename="attachment.txt"
Content-Type: text/plain
[file content goes there]
------WebKitFormBoundaryWfPNVh4wuWBlyEyQ
{
"id": "fragment-id/file-id",
"name": "Document Name.doc",
"size": 452097
}
This endpoint allows you to retrieve a file's signed URL that can be used to download the file.
GET /api/files/{fragmentId}/{fileId}
| URI Parameter | Requiered | Requirements | Description |
|---|---|---|---|
| fragmentId | Yes | String | The ID of the fragment |
| fileId | Yes | String | The ID of the file |
| Query Parameter | Requiered | Requirements | Description |
|---|---|---|---|
| download | No | Boolean | Get the file data blob if set to true. |
HTTP/1.1 200
{
"signedUrl": "aws-url"
}
This endpoint allows you to retrieve a fragment's files as a zip archive.
GET /api/files/{fragmentId}
| URI Parameter | Requiered | Requirements | Description |
|---|---|---|---|
| fragmentId | Yes | String | The ID of the fragment |
| Query Parameter | Requiered | Requirements | Description |
|---|---|---|---|
| fileTypes | No | Array(String) | Specify which file types to be included in the zip. All file types will be included if omitted |
HTTP/1.1 200
{
"dataBlob"
}
DELETE /api/file/{fileId}
| URI Parameter | Requiered | Requirements | Description |
|---|---|---|---|
| fileId | Yes | String | The ID of the file |
HTTP/1.1 204
FAQs
AWS S3 upload component for PubSweet
We found that @pubsweet/component-aws-s3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.