
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
aws-proxy-fetch
Advanced tools
Fetch web content behind a firewall with an AWS proxy.
Fetching web content from other websites from client-side usually either results in a CORS or a 403 Forbidden error. A typical workaround for this is to fetch it via a proxy server, but this is also usually blocked due to "Are you a human?" checks.
aws-proxy-fetch uses Puppeteer to get the actual page content, grabs the generated HTML, transforms and serves it.
Check out node-proxy-fetch for a platform agnostic approach.
Before you use this package, make sure that your environment has the correct configuration:
nodejs12.xx86_64This package cannot run on Node v14.x due to this error, and on Node v12.x due to this reason.
You'll need to manually create a layer for chrome-aws-lambda and add it to your Lambda function, here are the instructions. Alternatively, you can copy the layer ARN from here.
Install this package in your project and create a layer.
Finally, in your AWS Lambda code:
// Packages:
const Chromium = require('chrome-aws-lambda')
const fetch = require('aws-proxy-fetch').default
// Exports:
exports.handler = async (event, _context, _callback) => {
const fetchOptions = JSON.parse(event['fetchOptions'])
const response = {
statusCode: 200,
headers: {
'Access-Control-Allow-Origin': '*'
}
}
if (fetchOptions.type === 'DOCUMENT') {
const webpage = await fetch(Chromium, {
targetURL: fetchOptions.targetURL,
type: fetchOptions.type,
puppeteerOptions: {
baseURL: fetchOptions.puppeteerOptions.baseURL,
...fetchOptions.puppeteerOptions
},
...fetchOptions
})
response.body = webpage
} else if (fetchOptions.type === 'BLOB') {
const image = (await fetch({
targetURL: fetchOptions.targetURL,
type: fetchOptions.type,
...fetchOptions
})).fetchOptions
response.body = image
} else {
response.body = 'Invalid type!'
response.statusCode = 400
}
return response
}
Chromium
The imported Chromium class.
string
The target URL that you want to fetch.
FetchType = 'DOCUMENT' | 'BLOB'
The type of content you are fetching.
AxiosOptions - OPTIONAL
Options for Axios, only used when type is BLOB.
AxiosRequestConfig<any> - OPTIONAL
AxiosRequestHeaders - OPTIONAL
PuppeteerOptions - OPTIONAL
string
The base URL with the pattern protocol://domain.tld. All relative paths in the fetched HTML is replaced with this.
number - OPTIONAL
The number of milliseconds to wait for before scraping the HTML. This gives time for the Javascript to run on the page. Defaults to 5000.
boolean - OPTIONAL
Whether to transform relative paths with the baseURL or not. Defaults to true.
Partial<PuppeteerOptions> - OPTIONAL
Launch options for Puppeteer.
string[] - OPTIONAL
Launch arguments for Puppeteer.
MIT
FAQs
Fetch web content behind a firewall with an AWS proxy.
We found that aws-proxy-fetch demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.