
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
Lambcycle is a declarative lambda middleware. Its main purpose is to let you focus on the specifics of your application by providing a configuration cycle.
# with npm
npm install --save lambcycle
# with yarn
yarn add lambcycle
Lambcycle is a middleware for lambda functions. It defines a configurable life-cycle and allows you to focus on your application's logic. It has a "Feature as Plugin" approach, so you can easily create your own plugins or reuse your favorite packages with very little effort 🐑 🛵.
Checkout the following example or follow the link to 🎉 see some actual code 🎉 .
// with es6
import Joi from "joi";
import lambcycle from "lambcycle";
import pinoPlugin from './myPinoPlugin'
import joiPlugin from './myJoiPlugin'
import bodyParserPlugin from './myBodyParserPlugin'
import applicationLogic from "./mycode";
const processData = async (event, context) => {
// beautiful application logic ...
const manipulateData = event => {
// ...
};
return await applicationLogic(manipulateData(event), context);
};
const schema = Joi.object()
.keys({
username: Joi.string().alphanum().min(5).required(),
password: Joi.string().regex(/^[a-zA-Z0-9]{5,30}$/),
email: Joi.string().email({ minDomainAtoms: 2 })
});
const handler = lambcycle(processData).register([
pinoPlugin,
bodyParserPlugin,
joiPlugin(schema)
]);
export default handler;
The lifecycle provides a clear guideline to reason about your needs. Every step of the cycle can handle or throw errors making it easy to log, report or debug.
As you can see from the lifecycle graph above, the error object is a first class citizen that will stop the cycle and execute any error plugins declared in the register, it will then proceed to call the lambda handler's callback. Have a look at the Wrapper Interface to see what's available for reporting.
HINT: pretty much everything.
import lambcycle from 'lambcycle'
import notifyError from './myErrorNofifier'
const appLogic = async(event, context) => {
const {error, data} = await amazingJob()
if(error) {
throw error
}
}
const errorNotifier = {
plugin: {
onError: async (handler) => {
/**
* See IWrapper interface
*/
await notifyError(handler.error)
}
}
}
const handler = lambcycle(appLogic).register([errorNotifier])
export default handler;
handler.event.body property.A plugin is an object that can attach its hooks to one or more event cycles, it may provide its own configuration object.
type IPluginHookFunction = (
wrapper: IWrapper,
config: object,
handleError?: Callback
) => void;
import * as Sentry from '@sentry/node';
import MyAwesomeIntegration from './MyAwesomeIntegration'
const sentryPlugin = (config) => {
Sentry.init({
dsn: `https://config.key@sentry.io/${config.project}`,
integrations: [new MyAwesomeIntegration()]
});
return {
config,
plugin: {
onPreResponse: async (handlerWrapper, config) => {
Sentry.captureMessage('some percentile log perhaps?')
},
onError: async (handlerWrapper, config) => {
Sentry.captureException(handlerWrapper.error);
}
}
}
}
export default sentryPlugin;
Let's reuse the example above. Make sure your lambdas follow the Principle of least privilege and your secrets stay SECRET ㊙️
import lambcycle from 'lambcycle'
import sentryPlugin from './sentryPlugin'
const myApplicationLogic = async (event, context) => {
await someLogic()
}
const handler = lambcycle(myApplicationLogic)
.register([
sentryPlugin({
key: process.env.SENTRY_KEY,
project: process.env.SENTRY_PROJECT,
})
]);
export default handler;
Lambcycle ships with type definitions, making the dev experience smoother 🚀 (VScode only).

This project has been built with lots of ❤️ and Typescript 🤣. It embraces the middleware pattern and uses types for consistency and documentation. If this approach seems familiar to you is because it was inspired by the awesome hapijs.
As you can see the possibilities are endless when it comes to plugins! Everyone is welcome to contribute! Feel free to create issues or prs.
FAQs
🐑 🛵 A declarative lambda middleware with life cycle hooks 🐑 🛵
We found that lambcycle demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.