
Research
npm Malware Targets Telegram Bot Developers with Persistent SSH Backdoors
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
dynamodb-toolbox
Advanced tools
Lightweight and type-safe query builder for DynamoDB and TypeScript.
💖 Huge thanks to the sponsors who help me maintain this repo:
DynamoDB-Toolbox is a light abstraction layer over the DocumentClient that turns your DynamoDB journey into a ✨ bliss ✨
🤗 Simpler queries: DynamoDB-Toolbox does all the heavy-lifting of crafting those complex DynamoDB requests. It makes your code clearer, more concise and easier to maintain.
📐 Data validation: Both pushed and fetched items are validated against your schemas, which guarantees the consistency of your data and the reliability of your code.
✨ A rich schema syntax that supports a broad range of edge cases like defaults, composition, transformation and polymorphism.
🌈 Type-safety pushed to the limit: Increase your development velocity with instantaneous feedbacks and slick auto-completion.
🌴 Tree-shakable: Only import what you need.
☝️ Single-table designs: DynamoDB-Toolbox makes querying multiple entities within the same table extremely simple, although it works just as well with multiple tables.
🪶 LLRT compatible: DynamoDB-Toolbox has no dependency and can be used within LLRT functions.
[!TIP]
Want to get more our of your code? Try DynamoDB-Toolshack 🙌DynamoDB-Toolshack is a SaaS that connects to DynamoDB-Toolbox to elevate your DynamoDB experience with a schema-aware UI, table consitency checks and a migration system.
Join the Beta and get started in just a few clicks!
If you're here, we're assuming you know DynamoDB.
If you don't, check out the official AWS docs.
TLDR: DynamoDB is a key-value DB designed to run high-performance applications at any scale. It automatically scales up and down based on your current traffic, and removes the need to maintain connections, which makes it the go-to DB for many projects, including (but not limited to) serverless applications.
If you've ever used the official Document Client, you know that it’s painful to use.
Take a look at this UpdateCommand
example straight from the AWS documentation:
await documentClient.send(
new UpdateCommand({
TableName: 'Music',
Key: {
// 👇 No type-safety on the Primary Key
artist: 'Acme Band',
songTitle: 'Happy Day'
},
// 👇 Complex string expressions (+ still no type-safety)
UpdateExpression: 'SET #Y = :y, #AT = :t',
// 👇 Attribute names provided separately
ExpressionAttributeNames: {
'#AT': 'albumTitle',
'#Y': 'year'
},
// 👇 Attribute values as well
ExpressionAttributeValues: {
// 👇 No validation or type-safety to enforce DB schema
':t': 'Louder Than Ever',
':y': '2015'
},
ReturnValues: 'ALL_NEW'
})
)
It's a very simple example (updating two fields of a Music
item), yet already complex 😰
Things only get messier as your data grows in complexity: What if your items have many attributes, with some of them deep or optional? What if you need to index an item based on its value or handle different types of items? What about polymorphism?
In those cases, which are fairly common, the required code to generate those requests gets very hard to maintain. That's when DynamoDB-Toolbox comes to the rescue 💪
Here's is a quick preview with the DynamoDB-Toolbox version of the UpdateCommand
described above:
// Validated AND type-safe syntax 🙌
await MusicEntity.build(UpdateItemCommand)
.item({
artist: 'Acme Band',
songTitle: 'Happy Day',
albumTitle: 'Louder Than Ever',
year: '2015'
})
.options({ returnValues: 'ALL_NEW' })
.send()
And just like that, we went from an obscure 20 lines to a readable and elegant 10-liner 🤩
Not bad, eh? Let's get started!
FAQs
Lightweight and type-safe query builder for DynamoDB and TypeScript.
We found that dynamodb-toolbox demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Malicious npm packages posing as Telegram bot libraries install SSH backdoors and exfiltrate data from Linux developer machines.
Security News
pip, PDM, pip-audit, and the packaging library are already adding support for Python’s new lock file format.
Product
Socket's Go support is now generally available, bringing automatic scanning and deep code analysis to all users with Go projects.