
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
oss-upload-tool
Advanced tools
oss-upload-toolIntegrated oss upload
Complete integration COS-OSS / ALI-OSS / S3-OSS, Welcome to improve together.
Using npm:
npm install oss-upload-tool --save-dev
Using yarn:
yarn add oss-upload-tool -D
The tool will prioritize the identification of environment variables for easy invocation.
Before use, please register environment variables in advance to facilitate use. In CI/Action, you can set environment variables to prevent exposure of OSS parameters.
# General parameters
npm config --global set oss_upload_tool_secret_id "your secret_id"
npm config --global get oss_upload_tool_secret_key "your secret_key"
npm config --global get oss_upload_tool_bucket "your bucket"
npm config --global get oss_upload_tool_region "your region"
There are the following environment variables.
It is recommended to set the environment variable corresponding to oss first, then you do not need to specify the type of oss service provider.
# General parameters
npm config get oss_upload_tool_secret_id
npm config get oss_upload_tool_secret_key
npm config get oss_upload_tool_bucket
npm config get oss_upload_tool_region
# cos-oss
npm config get oss_upload_tool_cos_secret_id
npm config get oss_upload_tool_cos_secret_key
npm config get oss_upload_tool_cos_bucket
npm config get oss_upload_tool_cos_region
# ali-oss
npm config get oss_upload_tool_alioss_secret_id
npm config get oss_upload_tool_alioss_secret_key
npm config get oss_upload_tool_alioss_bucket
npm config get oss_upload_tool_alioss_region
npm config get oss_upload_tool_alioss_endpoint
# s3-oss
npm config get oss_upload_tool_s3_secret_id
npm config get oss_upload_tool_s3_secret_key
npm config get oss_upload_tool_s3_bucket
npm config get oss_upload_tool_s3_region
Get parameter priority parameters > process.env.[key] > npm config get [key].
oss-upload-tool -t "./lib/**" -d "./__xxx","__xxx1/" --bucket "***" --region "***" --oss "S3"
const ossUpload = require('oss-upload-tool');
// upload cos-oss
await ossUpload({
targets: {
src: './lib/**/*',
dest: ['__xxx/', '__xxx1/'],
},
uploadParams: {
Bucket: '***',
Region: '***',
},
COSOptions: {
SecretId: '***',
SecretKey: '***',
},
});
// upload ali-oss
await ossUpload({
targets: {
src: './lib/**/*',
dest: ['__xxx/', '__xxx1/'],
},
ALIOptions: {
accessKeyId: '***',
accessKeySecret: '***',
bucket: '***',
region: '***',
endpoint: '***',
},
});
// upload s3-oss
ossUpload({
targets: {
src: './lib/**/*',
dest: ['__xxx/', '__xxx1/'],
},
uploadParams: {
Bucket: '***',
},
S3Options: {
credentials: {
accessKeyId: '***',
secretAccessKey: '***',
},
region: '***',
},
})
Upload configuration
array | object
string | string[] globby patterns.string | string[] Upload path, If it is an array, it will upload to multiple directories.bool Delete the directory structure of uploaded files.string | (path: string, ext: string) => string Uploaded file name.(Buffer) => Buffer | string Upload file content.COS | ALI | S3 default COSimport('cos-nodejs-sdk-v5').SliceUploadFileParamsimport('ali-oss').PutObjectOptionsimport('aws-sdk').S3.Types.PutObjectRequestobject https://github.com/tencentyun/cos-nodejs-sdk-v5object https://github.com/ali-sdk/ali-oss#node-usagenumber default 5string
existCheckcheck, if the default cdn domain name cannot be accessed, use the open access cdn domain name to check
number default 1000 * 60 * 30boolean | patterns default falseetag first.
If there is no etag, as long as the request returns 200, it will be skipped.number default 0string default process.cwd()FAQs
Integrated oss upload
The npm package oss-upload-tool receives a total of 127 weekly downloads. As such, oss-upload-tool popularity was classified as not popular.
We found that oss-upload-tool demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.