
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
DAF allows you to outsource parts of a NodeJS app to FaaS
In addition to existing tools, it supports:
npm i -g daf # install globally
// l
var a = 1;
// lend
$ daf OPTIONS...
Options:
--fpath PATH: The path to the .js file in which you want to faasify code--linenum NUM: The line number of the // l ... Annotation. Beware, it's 0-indexed.--outpath PATH: The path where the generated FaaS functions will be put (outpath/lambdas/...).--commentout]: If specified, the faasified section will be replaced with an Lambda API call. Don't forget to specify //l name(...)!Upcoming: https://github.com/qngapparat/daf-vscode
The tool creates an equivalent Lambda function of that section in [--output]/lambdas/[name]:
└── lambdas
└── 28723n2398jfs9f87239uhfe9
├── index.js
└── package.json
You can deploy this function directly to AWS Lambda.
One file can have multiple // l ... // lend sections, that can be converted separately.
//l can be followed by any combination of these space-separated directives.
nameYou can give your Lambda a name to better keep track of it:
// l name(mylamb)
var a = 1
// lend
└── lambdas
└── mylamb
└── ....
varsYour code might rely on global variables. You can denote them with vars():
var a = 1
// l vars(a)
a++
// lend
They will be added to the scope inside the Lambda.
requireYour code might rely on functions from other files. You can declare that using require():
// l require(./foo.js as foo)
foo()
// lend
A portable version of foo.js is then included in the deployment package, and it is added to the scope inside the Lambda.
└── lambdas
└── myfunc
└── foo.js // <---
└── ...
If foo in turn depends on other functions or dependencies, they are bundled as well (recursively) using webpack.
installYour code might depend on NPM packages. You can specify them with install(). They will be included in your deployment package.
// l install(opencv2)
....
// lend
You probably want to import it as well:
// l install(opencv2) require(opencv2)
opencv2.detectFaces(...)
// lend
returnYour monolith code may have no return statement. To receive something back from the lambda, use return()
// l return(a)
var a = 1
var b = 2
// lend
With most // l expressions, you can provide a comma-separated list too:
// l vars(a, b, c)
...
You can rename functions and packages, when import them:
// l require(opencv2 as cv)
cv.detectFaces(...)
// lend
This is obligatory if you import local functions.
You can specify the exact versions of the NPM packages to install:
// l install(pkg1@latest, pkg2^1.0.0, pkg3>=1.2.3)
...
// lend
The syntax follows this official schema: https://docs.npmjs.com/misc/semver
FAQs
Dependency-aware FaaSifier for NodeJS monoliths
The npm package daf receives a total of 1 weekly downloads. As such, daf popularity was classified as not popular.
We found that daf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.