Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
s3-folder-upload
Advanced tools
A little script to upload statics to a S3 bucket by using the official Amazon SDK.
In order to use this module, you'll need to have AWS Credentials. You can load them, two ways:
AWS_CREDENTIALS_PATH
and it should have accessKeyId
, secretAccessKey
, region
and bucket
.npm install s3-folder-upload -D
In case you want to use the CLI, you can install it globally:
npx s3-folder-upload
const s3FolderUpload = require('s3-folder-upload')
// or the ES6 way
// import s3FolderUpload from 's3-folder-upload'
const directoryName = 'statics'
// I strongly recommend to save your credentials on a JSON or ENV variables, or command line args
const credentials = {
"accessKeyId": "<Your Access Key Id>",
"secretAccessKey": "<Your Secret Access Key>",
"region": "<Your Aimed Region>",
"bucket": "<Your Bucket Name>"
}
// optional options to be passed as parameter to the method
const options = {
useFoldersForFileTypes: false,
useIAMRoleCredentials: false
}
// optional cloudfront invalidation rule
const invalidation = {
awsDistributionId: "<Your CloudFront Distribution Id>",
awsInvalidationPath: "<The Path to Invalidate>"
}
s3FolderUpload(directoryName, credentials, options, invalidation)
useFoldersForFileTypes
(default: true
): Upload files to a specific subdirectory according to its file type.useIAMRoleCredentials
(default: false
): It will ignore all the credentials passed via parameters or environment variables in order to use the instance IAM credentials profile.uploadFolder
(default: undefined
): If it's specified, the statics will be uploaded to the folder, so if you upload static.js
to https://statics.s3.eu-west-1.amazonaws.com
with a uploadFolder
with value my-statics
the file will be uploaded to: https://statics.s3.eu-west-1.amazonaws.com/my-statics/static.js
.ACL
(default: public-read
): It defines which AWS accounts or groups are granted access and the type of access.CacheControl
(default: public, max-age=31536000
): HTTP header holds directives (instructions) for caching in both requests and responses.Expires
(default: 31536000
): Header contains the date/time after which the response is considered stale. If there is a Cache-Control header with the max-age or s-maxage directive in the response, the Expires header is ignored.If you use programatically the library, you could overwrite the ACL
, CacheControl
and Expires
values to file level.
const options = {
useFoldersForFileTypes: false,
useIAMRoleCredentials: false,
}
const filesOptions: {
'index.html': {
CacheControl: 'public, max-age=300',
Expires: new Date("Fri, 01 Jan 1971 00:00:00 GMT")
}
}
s3FolderUpload(directoryName, credentials, options, filesOptions)
s3-folder-upload <folder>
Example:
s3-folder-upload statics
For the AWS Credentials
AWS_CREDENTIALS_PATH
with the path of the file with the needed info.s3-folder-upload <folder> --accessKeyId=<your access key id> --bucket=<destination bucket> --region=<region> --secretAccessKey=<your secret access key>
useIAMRoleCredentials
option in order to rely on IAM Profile instance instead any passed by variables and environmentFor Options
s3-folder-upload <folder> <credentials parameters> --useFoldersForFileTypes=false
For CloudFront invalidation
s3-folder-upload <folder> <credentials parameters> --awsDistributionId=<distributionId> --awsInvalidationPath="/js/*"
S3_FOLDER_UPLOAD_LOG
: You could specify the level of logging for the library.
none
: No logging outputonly_errors
: Only errors are loggedall
(default): Errors, progress and useful messages are logged.Example of use:
S3_FOLDER_UPLOAD_LOG=only_errors s3-folder-upload <folder>
If you use the library programatically, this ENVIRONEMNT_VARIABLE will be read as well. For example:
S3_FOLDER_UPLOAD_LOG=only_errors node upload-script.js
FAQs
Upload statics to S3 server
The npm package s3-folder-upload receives a total of 28,560 weekly downloads. As such, s3-folder-upload popularity was classified as popular.
We found that s3-folder-upload demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.