Security News
pnpm 10.0.0 Blocks Lifecycle Scripts by Default
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
npm-pack-zip
Advanced tools
This tool will create an archive of your package similar to npm pack
, but will generate a zip file instead of a tarball.
It is designed to help you deploy NPM packages to AWS Lambda or Azure Web Apps.
This project uses the npm-packlist project to build up the list of files to include and all bundle dependencies. Check out their documentation on how to exclude files from the archive.
npm install --save-dev npm-pack-zip
my-lambda is an npm package I want to run as an AWS Lambda Function.
Install pack-zip locally in my-lambda
npm install --save-dev npm-pack-zip
Install any runtime dependencies of my-lambda.
npm install
Modify my-lambda/package.json:
"scripts": {
"pack": "npm-pack-zip"
...
}
Create the .zip file containing my-lambda and its dependencies, ready to upload to AWS Lambda
npm run pack
If you need to create *.zip
package with static date modified of the files inside then you can use the flag --static-date-modified
. This can be used if you are using automation deployment to the AWS, where the server checkouts the code (brand new) each time deployment is triggered. Hash can be calculated so that you can check with the hash in AWS so that you can check if the code is changed.
"scripts": {
"pack": "npm-pack-zip --static-date-modified"
...
}
"scripts": {
"pack": "npm-pack-zip --sdm"
...
}
FAQs
Run npm pack to generate a .zip archive file
We found that npm-pack-zip demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.
Research
Security News
Socket researchers have discovered multiple malicious npm packages targeting Solana private keys, abusing Gmail to exfiltrate the data and drain Solana wallets.