
Research
/Security News
Mini Shai-Hulud Campaign Hits Red Hat Cloud Services npm Packages
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.
serverless-plugin-artifact-manager
Advanced tools
A serverless plugin that dynamically manages artifactDirectoryName to ensure CloudFormation detects code changes
A Serverless Framework plugin that dynamically manages artifactDirectoryName to ensure CloudFormation properly detects Lambda code changes.
When deploying Lambda functions, CloudFormation uses the artifactDirectoryName to determine if there have been code changes. If this path doesn't change between deployments, CloudFormation assumes no code changes occurred and skips the Lambda update - even if your code has actually changed.
This plugin solves that problem by:
npm install --save-dev serverless-plugin-artifact-directory-manager
Add the plugin to your serverless.yml:
plugins:
- serverless-plugin-artifact-directory-manager
package:
excludeDevDependencies: false
individually: ${env:SERVERLESS_WEBPACK_INDIVIDUALLY, false}
artifactDirectoryName: ${artifactDir:fullPath}
patterns:
- "!.vscode/**"
- "!.test/**"
- "!./logo.png"
- "!node_modules/**"
Configure the plugin behavior:
plugins:
- serverless-plugin-artifact-directory-manager
custom:
artifactDirectoryManager:
strategy: hash # Options: 'hash' (default), 'timestamp', 'hybrid'
includeGitCommit: true # Include git commit hash in directory name
verbose: true # Enable verbose logging
enableCache: true # Enable build caching (default: true for hash/hybrid, false for timestamp)
package:
artifactDirectoryName: ${artifactDir:fullPath}
hash (default): Changes only when code changes (most efficient, only rebuilds when necessary)timestamp: Changes with every deployment (guarantees uniqueness but may cause unnecessary rebuilds)hybrid: Combines both approaches for guaranteed uniqueness and change detection| Strategy | Efficiency | Reliability | Use Case | Pros | Cons |
|---|---|---|---|---|---|
hash ⭐ | 🟢 High | 🟡 Good | Most projects | • Only updates when code changes • Faster deployments • Lower AWS costs • Matches original behavior | • Rare edge cases where CloudFormation needs update but hash doesn't change |
timestamp | 🔴 Low | 🟢 Perfect | Critical systems | • Guarantees CloudFormation detection • Never misses updates • Simple and predictable | • Updates Lambda on every deploy • Slower deployments • Higher AWS costs • Unnecessary cold starts |
hybrid | 🟡 Medium | 🟢 Perfect | High-change environments | • Best of both worlds • Content-aware + guaranteed unique • Good for rapid development | • Slightly larger hash • More complex logic • Still updates more than pure hash |
Choose hash (default) when:
Choose timestamp when:
Choose hybrid when:
hash - it's the most efficient and matches your original setuptimestamp temporarily if you suspect deployment detection issueshybrid for development environments with frequent changesThe plugin provides several variable resolvers you can use in your serverless.yml:
package:
artifactDirectoryName: ${artifactDir:fullPath} # Full path: serverless/myservice/dev/2024-01-15T10-30-00-abc123def456
# Or use individual components:
custom:
myTimestamp: ${artifactDir:timestamp} # 2024-01-15T10-30-00
myHash: ${artifactDir:hash} # abc123def456
myPrefix: ${artifactDir:prefix} # serverless/myservice/dev
myService: ${artifactDir:service} # myservice
myStage: ${artifactDir:stage} # dev
myRegion: ${artifactDir:region} # us-east-1
serverless artifact-info # Basic info
serverless artifact-info --verbose # Detailed info
package.artifactDirectoryName if neededThe hash and hybrid strategies calculate content hashes from:
✅ Always Included:
package.json - Dependencies and project configurationserverless.yml - Serverless configurationsrc/**/*.{js,ts,json,yml,yaml})✅ Conditionally Included:
package-lock.json, yarn.lock, pnpm-lock.yaml - When present.env, .env-hd, .env.local, .env.production) - When presentincludeGitCommit: true❌ Always Excluded:
node_modules/ - Too large and volatile.git/, .vscode/, etc.)🗂️ Artifact Directory Manager - Configuration Injected
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
📋 Core Properties:
Service: my-api
Stage: dev
Region: us-east-1
📁 Directory Details:
Timestamp: 2024-01-15T10-30-00
Hash: abc123def456
Prefix: serverless/my-api/dev
Full Path: serverless/my-api/dev/2024-01-15T10-30-00-abc123def456
💡 Usage:
Use ${artifactDir:fullPath} in your serverless.yml
Use ${artifactDir:timestamp} for timestamp-only
Use ${artifactDir:hash} for hash-only
Use ${artifactDir:prefix} for prefix-only
━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
Enable verbose logging:
export ARTIFACT_DIR_DEBUG=true
serverless deploy --verbose
Or use the plugin-specific command:
serverless artifact-info --verbose
If you're currently using:
package:
artifactDirectoryName: ${file(../../serverless/core/dist/serverless-artifact.js):artifactDirectoryName, file(./dist/serverless-artifact.js):artifactDirectoryName, file(./node_modules/@emerald-works/serverless-core/dist/serverless-artifact.js):artifactDirectoryName}
Simply replace with:
plugins:
- serverless-plugin-artifact-directory-manager
package:
artifactDirectoryName: ${artifactDir:fullPath}
The plugin includes an intelligent caching system that can dramatically speed up deployments by skipping unnecessary builds and uploads:
custom:
artifactDirectoryManager:
strategy: hash # Required for caching
enableCache: true # Enable build caching (default: true for hash/hybrid)
✅ Cache Hit: Build skipped, existing artifacts reused
❌ Cache Miss: Normal build process continues
custom:
artifactDirectoryManager:
enableCache: true # Enable/disable caching (default: smart)
strategy: 'hash' # Required for caching ('timestamp' disables cache)
includeGitCommit: true # Include git state in cache key
Smart Defaults:
hash strategy: Cache enabled by defaulthybrid strategy: Cache enabled by defaulttimestamp strategy: Cache disabled by defaultgit checkout -b feature/amazing-feature)git commit -m 'Add some amazing feature')git push origin feature/amazing-feature)MIT License - see the LICENSE file for details.
--verbose flagARTIFACT_DIR_DEBUG=trueFAQs
A serverless plugin that dynamically manages artifactDirectoryName to ensure CloudFormation detects code changes
We found that serverless-plugin-artifact-manager demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
A mini Shai-Hulud campaign compromised Red Hat Cloud Services npm packages to steal developer and CI/CD secrets during installation.

Research
/Security News
The North Korean malware loader hides in a Packagist-listed package and its GitHub branch to fetch and execute remote code in a likely Contagious Interview-style lure.

Security News
The Rust project is moving toward formal rules on LLM use in contributions after months of internal debate over maintainer burden, code quality, and contributor experience.