
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
It was mainly designed to help deploy node.js functions to AWS Lambda.
When deploying node.js codes to AWS lambda, all dependent modules needed to be included. But if you simply zip all content node_modules/ folder, the final media may be messed up with some dev dependencies. So to exclude the dev dependencies, initially I found node-pack-zip , but @jogoussard found this repo did not support transitive dependencies (see issue#2). and then he forked and created node-repack-zip.
As the .packignore config file in original design only did files exclusion, but in my case, I only need to specify which files should be included. So I modified node-repack-zip repo, and created a new one. You should explicitly specify the files you want to include or exclude in the config files.
npm install --save-dev lambda-zip
my-lambda is an npm package I want to run as an AWS Lambda Function.
Install lambda-zip locally in my-lambda
npm install --save-dev lambda-zip
Install any runtime dependencies of my-lambda.
npm install
Add a config file in the root of my-lambda, let's say .dev it's content will be like .gitignore, using ! to exclude files, for example
index.js
lib/**/*
proj/**/*
!lib/test.js
Modify my-lambda/package.json:
"scripts": {
"build-aws-lambda": "lambda-zip .dev lambda.zip -a -v"
...
}
Create the lambda.zip file containing my-lambda and all its dependencies, ready to be uploaded to AWS Lambda
npm run build-aws-lambda
0.3.2 - refine the original codes
add excluding aws-sdk option
add verbose mode option and some running information
0.3.1 - remove .packignore file, and all files are not included by default.
0.2.5 - Added support for root module _phantomChildren dependencies.
0.2.4 - Initial published release
FAQs
Zips a node module with its declared dependencies.
The npm package lambda-zip receives a total of 28 weekly downloads. As such, lambda-zip popularity was classified as not popular.
We found that lambda-zip demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.