
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Install with npm:
npm i --save deploy-s3
In your package.json, you must have the following properties defined:
"name": "oms-ui"
"deploy": "myDeployDirectory/"
In a file or in env variables, you must have the credentials for using S3:
{
"key": "somestring",
"secret": "somebigstring"
}
In your task runner, create a knox-compatible S3 client and deploy:
S3Deployer = require 'deploy-s3'
# Read your package.json file
pkg = JSON.parse fs.readFileSync './package.json'
# Read your access key and secret key
credentials = JSON.parse fs.readFileSync '/credentials.json'
# Choose your bucket
credentials.bucket = 'vtex-io'
# Create a client with your credentials
client = knox.createClient credentials
# Create a new S3Deployer
deployer = new S3Deployer(pkg, client)
doneHandler = -> console.log 'Done'
failHandler = console.error
progressHandler = console.log
# deploy() returns a promise and notifies of each uploaded file
deployer.deploy().then doneHandler, failHandler, progressHandler
This will cause every file under myDeployDirectory/
to be deployed to the vtex-io
bucket under the oms-ui
directory.
If your doneHandler is called, that means your deploy is complete.
S3Deployer accepts a third parameter with options:
dryrun: if upload should be skipped. Defaults to false.
chunk: how many files to upload in parallel. Defaults to 20.
batchTimeout: timeout for entire upload. millis. Defaults to 1000 * 60 * 5.
fileTimeout: timeout for upload of each file. millis. Defaults to 1000 * 30.
FAQs
Deploy front end apps to S3
The npm package deploy-s3 receives a total of 7 weekly downloads. As such, deploy-s3 popularity was classified as not popular.
We found that deploy-s3 demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.