Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
serverless-build-client
Advanced tools
A Serverless Framework plugin used to build front end applications
A Serverless Framework plugin for building the frontend with environment variables defined in serverless.yml
Plugins such as serverless-finch
make it easy to host static websites in S3. These websites usually need to be built before being uploaded. Without this plugin, environment variables defined in serverless.yml
will not be included in the build.
First, install the package to your dev dependencies
$ yarn add --dev serverless-build-client
Then add the plugin to your serverless.yml
file
...
plugins:
- serverless-build-client
...
In your command prompt, run the following command to build the client
serverless client build
This will add all of the environment variables in your serverless.yml
file to process.env
, and then it will execute yarn build
to build the frontend
--packager
, -p
The packager that should be used to build the client. Valid options are yarn
and npm
. Default value is yarn
$ serverless client build --packager yarn
--command
, -c
The command that will build the client. Default value is build
for yarn and run build
for npm
$ serverless client build --packager yarn --command build
$ serverless client build --packager npm --command "run build"
--cwd
, -d
The directory that will be used to run the packager. Default value is the current folder. This option is intended for use when the client package.json is in a subfolder or alternate folder.
$ serverless client build --packager npm --command "run build" --cwd client
--verbose
, -v
Flag that determines if we should print the environment variables to the console. Default value is false
$ serverless client build --verbose
The above options may also be configured using custom configuration options in your servless.yml
file
...
custom:
buildClient:
packager: npm
command: run build
cwd: client
verbose: true
Environment variables may be set for the entire provider:
provider:
environment:
REACT_APP_BACKEND_ENDPOINT: ${cf:<backend service name>.ServiceEndpoint}
Or they may be set specificly for this plugin:
custom:
buildClient:
environment:
REACT_APP_BACKEND_ENDPOINT: ${cf:<backend service name>.ServiceEndpoint}
The plugin will apply both provider environment variables and specific plugin environment variables. In the case of a conflict, the specific plugin environment variable will override the provider environment variable.
Let's say you have two separate Serverless Framework projects: one for the frontend, and one for the backend. When you deploy the backend service, a ServiceEndpoint
is automatically outputted in the CloudFormation stack.
In order to avoid hardcoding this value, the frontend should reference an environment variable containing the endpoint. In your frontend's serverless.yml
file, you would have something similar to
...
provider:
...
environment:
REACT_APP_BACKEND_ENDPOINT: ${cf:<backend service name>.ServiceEndpoint}
...
or
...
custom:
buildClient:
environment:
REACT_APP_BACKEND_ENDPOINT: ${cf:<backend service name>.ServiceEndpoint}
...
To deploy your front end, you need to run a series of commands (in this example, I am using serverless-finch
)
$ serverless deploy
$ serverless client build
$ serverless client deploy --no-confirm
These commands will first deploy your application to AWS. Then it will build the front end with the environment variable defined above. Then it will upload the built website to S3.
FAQs
A Serverless Framework plugin used to build front end applications
The npm package serverless-build-client receives a total of 685 weekly downloads. As such, serverless-build-client popularity was classified as not popular.
We found that serverless-build-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.