
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
ls-lambda-helpers
Advanced tools
Helpers used to aid in rapid developement and coding consistentcy.
npm install ls-lambda-helpers
Standard helpers take a argument such as an apiKey when calling a method. This helper differs in that it uses specified named Environmental Variables. This makes it a little less flexible but much more powerful in that it requires you to use AWS Secrets Manager.
Create log levels between environments
service: service-name
custom:
logLevel:
dev: 'debug'
qa: 'info'
preprod: 'info'
prod: 'error'
provider:
environment:
STAGE: ${self:provider.stage}
LOG_LEVEL: ${self:custom.logLevel.${self:provider.stage}}
** Note: If you do not need custom level for each stage and only want to override PROD then only include STAGE: ${self:provider.stage}
const { Logger } = require('ls-lambda-helpers');
const console = new Logger();
exports.handler = async (event, context) => {
console.info("Event", event);
console.audit("Context", context);
}
When using Lambda Proxy with ApiGateway this will return the proper response back to the client.
const { Response } = require('ls-lambda-helpers');
exports.handler = async (event, context) => {
const {queryStringParameters:{test}} = event;
if (test != "string") return new Response("Your input is garbage").fail();
return new Response("Looks Good").sucess();
}
Retrieves AWS Secret by name. Secret must be in json (key: value) format.
Create a new secret in Secrets Manager and record the name.
const { Secrets } = require('ls-lambda-helpers');
const {SECRET_NAME} = process.env;
exports.handler = async (event, context) => {
const secret = await Secrets.getSecret(SECRET_NAME);
console.log('SECRET:', secret)
}
Handles authentication and updating expired tokens in AWS SSM parameter store.
As of now you must use SSM Parameter Store but a refactor will be coming to move to Secrets Manager
service: service-name
provider:
environment:
DDQ_URL: https://url-to-ddq-endpoint
DDQ_TOKEN: /ddq/dev/token
DDQ_CREDENTIALS: /ddq/dev/credentials
DDQ_SESSION_TOKEN: /application-name/dev/ddq/session
const { DDQ } = require('ls-lambda-helpers');
...
exports.handler = async (event, context) => {
const session = await DDQ.ddqAuth();
const orderHeader = await getOrderHeader(session.ddqToken, orderId);
}
Handles authentication and calling SalesForce Marketing Cloud DataExtension API
You must use AWS SecretesManager to store your credentials. Please store creds in the following format: clientId:{ID}, clientSecret:{SECRET}
service: service-name
provider:
environment:
SFMC_SECRET_NAME: name-of-secret
const { SFMC } = require('ls-lambda-helpers');
// This is the URL path after /data/v1/async/dataextensions/key:
const {SFMC_URL_METHOD} = process.env;
exports.handler = async (event, context) => {
const postRes = await SFMC.postAPI(SFMC_URL_METHOD, {items:[{item1:'value1', item2:'value2'}]});
console.log('POST RES:', postRes);
}
Handles JWT tokens decoding and validations.
The JWT helper has inbuilt functions that take a JWT token to manage their data.
const { JWT } = require('ls-lambda-helpers');
exports.handler = async (event, context) => {
const token = JSON.parse(event.body);
// DECODE: Decodes the info inside a token.
const decodedToken = JWT.decode(token);
// HAS EXPIRED: Tells if a token has expired.
const isExpired = JWT.hasExpired(token);
// You can pass the decoded token to this method if you already did it before.
const isExpiredFromString = JWT.decodedTokenHasExpired(decodedToken);
}
FAQs
Helpers that aid fast lambda creation
The npm package ls-lambda-helpers receives a total of 4 weekly downloads. As such, ls-lambda-helpers popularity was classified as not popular.
We found that ls-lambda-helpers demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.