Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
aws-cdk-web
Advanced tools
:muscle: AWS CDK compiled for web (and Node!)
cdk-web and aws-cdk-web are functionally identical packages on
npm
. read about the differences below.
usage | docs | tests | types | docs |
---|
npm
npm install --save cdk-web aws-sdk
unpkg
<script src="https://sdk.amazonaws.com/js/aws-sdk-2.1000.0.min.js"></script>
<script src="https://unpkg.com/cdk-web"></script>
const CDK = require("cdk-web");
const cdk = CDK.require("aws-cdk-lib");
const ec2 = CDK.require("aws-cdk-lib/aws-ec2");
const sqs = CDK.require("aws-cdk-lib/aws-sqs");
const sns = CDK.require("aws-cdk-lib/aws-sns");
const s3 = CDK.require("aws-cdk-lib/aws-s3");
const app = new cdk.App();
const stack = new cdk.Stack(app, "BrowserStack");
const vpc = new ec2.Vpc(stack, "VPC");
const queue = new sqs.Queue(stack, "Queue");
const topic = new sns.Topic(stack, "Topic");
const bucket = new s3.Bucket(stack, "Bucket");
const assembly = await app.synth();
console.log(assembly);
cdk-web
vs cdk
cdk-web
does not have a dependency on any NPM packagescdk-web
is and will always be compatible with "strict" modecdk-web
core framework weighs a whopping 200MB less than native CDKcdk-web
runs much faster than CDK thanks to it being entirely in-memorycdk-web
is a symmetrical package that works both in Node and web browserscdk-web
is compressed and goes through the Closure Compiler on each releasecdk-web
is arguably securer than CDK, again thanks to it being entirely in-memorycdk-web
allows you to Bring Your Own AWS SDK bundle (details here)npm run build
builds cdk-web. everything is bundled in dist/cdk-web.js
.
you may open up dist/index.html
in your browser if you want to just play with the compiled bundle.
you can build a dev bundle verbosely with DEBUG='CdkWeb*'
and CDK_WEB_DEBUG=1
environment variables set.
testing is done by Puppeteer. the actual generated bundle is loaded into Puppeteer and tests are executed against it.
run npm test
to execute them. tests are executed twice: once in Puppeteer vs. native CDK as ground truth, and once in
NodeJS to make sure the final bundle is also usable and sane in NodeJS-like environments. Coverage is also collected in
NodeJS mode solely due to the fact that currently the toolchain does not have sufficient support to collect coverage in
Puppeteer (which would be ideal). Although, NodeJS coverage is a good estimate of where everything is at.
cdk-web
ships with a single .d.ts
file that gives you the same typings as the native cdk. to get it to work, check
out docs/types.md. typings for aws-cdk-lib
and constructs
are bundled as well.
cdk-web
vs aws-cdk-web
The two packages are identical, mirrored, and released to at the same time.
You may use the other mirror if you are behind a corporate proxy and your
NPM packages go through a third-party repository such as Artifactory. The mirror does not list any packages as
devDependencies in its package.json. This prevents cdk-web
to be incorrectly flagged as vulnerable due to its outdated
devDependencies. cdk-web
is a compiled project. Its compiler and toolchain being outdated does not impact its runtime.
It's all client side JavaScript anyway. The mirror is only provided for your convenience.
FAQs
AWS CDK compiled for web (and Node!)
We found that aws-cdk-web demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.