
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
aws-lambda
Advanced tools
Deploy AWS Lambda functions from command line using a json or yaml config file.
Command line tool deploy code to AWS Lambda.
Versions prior to 1.0.5 suffer from "Command Injection" vulnerability,
thanks snyk.io and Song Li of Johns Hopkins University for reporting.
npm install -g aws-lambda
WARN: upgrading to v1.0.0 will remove your function environment and layers if they are not defined in the config file
lambda deploy <file.lambda> credentials needs permissions to CreateFunction, UpdateFunctionConfiguration and UpdateFunctionCodelambda delete <file.lambda> credentials needs permissions to DeleteFunctionlambda invoke <file.lambda> credentials needs permissions to InvokeFunction
{
"PATH": "./test-function",
"AWS_KEY": { "Ref" : "env.AWS_ACCESS_KEY_ID" },,
"AWS_SECRET": { "Ref" : "env.AWS_SECRET_ACCESS_KEY"},
"AWS_REGION": "us-east-1",
"FunctionName": "test-lambda",
"Role": "your_amazon_role",
"Runtime": "nodejs10.x",
"Handler": "index.handler",
"MemorySize": "128",
"Timeout": "3",
"Environment": {
"Variables": {
"Hello": "World",
}
},
"Layers": [
"arn:aws:lambda:eu-central-1:452980636694:layer:awspilot-dynamodb-2_0_0-beta:1"
],
"Tags": {
"k1": "v1",
"k2": "v2"
},
"Description": ""
}
# unlike json, comments are allowed in yaml, yey!
# remember to use spaces not tabs 😞
PATH: ./new-function
AWS_KEY: !Ref "env.lambda_deploy_aws_key"
AWS_SECRET: !Ref "env.lambda_deploy_aws_secret"
AWS_REGION: "eu-central-1"
FunctionName: new-function-v12
Role: "arn:aws:iam::452980636694:role/CliLambdaDeploy-TestRole-1H89NZ845HHBK"
Runtime: "nodejs8.10"
Handler: "index.handler"
MemorySize: "128"
Timeout: "3"
Environment:
Variables:
Hello: "World"
Layers:
- "arn:aws:lambda:eu-central-1:452980636694:layer:awspilot-dynamodb-2_0_0-beta:1"
Tags:
k1: v1
k2: v2
Description: ""
// if installed globally then
$ lambda deploy /path/to/my-function.lambda
$ lambda deploy ../configs/my-function.lambda
// if 'npm installed' without the -g then you must use the full path
$ node_modules/.bin/lambda /path/to/my-function.lambda
// you can also add it in your scripts section of your package.json scripts: { "deploy-func1": "lambda deploy ../config/func1.lambda" }
$ npm run deploy-func1
aws-lambda can also watch the config file and the code folder specified in the config.PATH for changes and re-reploy on change
$ lambda start ../configs/my-function.lambda
The serverless package is a framework for building and deploying serverless applications. It supports multiple cloud providers, including AWS, and provides a higher-level abstraction compared to aws-lambda. It includes features for managing infrastructure, deploying functions, and integrating with various services.
The aws-sdk package is the official AWS SDK for JavaScript. It provides a comprehensive set of APIs for interacting with AWS services, including Lambda. While it does not provide type definitions for Lambda events like aws-lambda, it is essential for making API calls to AWS services from your Lambda functions.
The claudia package is a tool for deploying Node.js projects to AWS Lambda and API Gateway. It simplifies the deployment process and provides utilities for managing Lambda functions and API Gateway configurations. It focuses on ease of use and quick deployment, similar to aws-lambda but with additional deployment features.
FAQs
Deploy AWS Lambda functions from command line using a json or yaml config file.
The npm package aws-lambda receives a total of 345,909 weekly downloads. As such, aws-lambda popularity was classified as popular.
We found that aws-lambda demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.