
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
aws-mongodump
Advanced tools
mongodumps directly to s3, does not pass go, does not create dump locally and then upload. streams and pipes all the way.
A node.js package to dump mongodb (mongodump) directly into s3 without filling up your local disk in the process.
NOTE: This is still a work in progress. Please don't rely on it as your only backup option, especially without some decent testing.
NOTE 2: You may need to upgrade your version of mongodump (by upgrading mongo) due to this issue: https://jira.mongodb.org/browse/SERVER-5233
npm install aws-mongodump
var dump = require('aws-mongodump').dump;
var now = +new Date(); // gives the current time as a number
dump("MY_MONGO_URI", "mongobackup-" + now, function (err, res) {
if (err) { throw err; }
console.log('results: ', res);
});
By default, dumpstr will check for a file in your working directory called "conf.js", which should look something like this.
// This file is called conf.js
module.exports = {
aws: {
key: "MY_KEY_IS_HERE"
, secret: "THIS_IS_SECRET_HERE"
, bucket: "I_HAS_A_BUCKET"
}
}
You can also update that path using setConfig.
var md = require('dumpstr')
, dump = md.dump;
md.setConfig("my_config_path/is_better.js");
Or you can supply a json config object directly using setConfigJson.
var md = require('dumpstr')
, dump = md.dump;
md.setConfigJson(json);
If you want to keep your configs in environment variables instead (Who could blame you?), go ahead and set these instead. That way you can leave out the config file entirely.
AWS_KEY
AWS_SECRET
AWS_BUCKET
@timisbusy for the providing pretty much all of this code base, added convict (json) config options and updated logger.
FAQs
mongodumps directly to s3, does not pass go, does not create dump locally and then upload. streams and pipes all the way.
We found that aws-mongodump demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.