Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
serverless-mono-plugin
Advanced tools
A Serverless plugin design to make it possible to use Serverless in a Javascript mono repo with hoisted dependencies, e.g. when using Yarn Workspaces.
This plugin alleviates the need to use nohoist functionality by creating symlinks to all declared dependencies. Development dependencies are deliberately NOT linked so these will not be packaged into the resulting archive.
Butterwire uses Yarn workspaces and we created this plugin to improve our development experience. Not using nohoist saves wasting disk space and also accidentally including development dependencies in our packaged functions.
Note, this package will only work on operating systems that support symbolic links!
yarn add --dev serverless-plugin-monorepo
# or using NPM
npm install --dev serverless-plugin-monorepo
Currently this plugin requires Node V8+. If there is interest in support older versions then trans-compilation with Babel could be added.
Add the plugin to your serverless.yml
file:
plugins:
- serverless-plugin-monorepo
The plugin listens for package lifecycle events. Prior to Serverless packaging
up the service, it will scan the package.json
file for dependencies and
ensure that all dependencies (including transitive dependencies) are symlinked in node_modules
.
Hence when Serverless creates the archive, it will follow the symlinks and all dependencies will be added as expected. Development/peer dependencies are ignored.
The plugin will run when you do:
sls deploy
)sls deploy -f
)sls offline [start]
)On Windows platforms only, the package will create junction links by default as these do not require administrative privileges on older versions of Windows.
You can set the linkType
setting to dir
to create symbolic links instead. This setting is directly passed to the fs.symlink function. It is ignored on non Windows platforms.
We welcome issue reports and pull requests!
There is a small run
script which will launch Node V8 in a Docker container which
you may find useful for development purposes.
Note we are using StandardJS and you can run
the lint tool via yarn lint
which will attempt to automatically issues like spacing etc.
Copyright Butterwire Limited 2018 - 2019
FAQs
Serverless plugin to allow use inside a JS monorepo
We found that serverless-mono-plugin demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.