Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
yaml-boost
Advanced tools
Basic Yaml Loading with additional functionality, i.e. resolve file depedencies, resolve variables, deep merge hierachies.
Useful for loading improved serverless configuration. For yaml loading this package uses js-yaml.
$ npm install --save yaml-boost
Resolve content with variables at given refPath.
Load filePath with given variables.
Note that this function is asynchronous.
As provided by js-yaml
through safeDump
import { load } from 'yaml-boost';
load('config.yaml');
Matching yaml.dump()
function is also available.
Works identical to how this is defined for serverless here.
Both yml
and yaml
file endings are supported.
${file(./path/to/file.yml), key1=value1&key2=value2}
You can reference packages by using
${require(PACKAGE):path.to.key.in.module}
Reference js instead of yaml files.
${file(./path/to/file.js)}
The reference file needs to export simple object containing configuration
export default {};
Reference function inside js file.
${fileFn(./path/to/file.js)}
The reference file needs to export simple function returning an object. Available variables are passed in.
export default (args) => ({ args });
Once can reference files relative to the current file by using ^
as a prefix like so
${file(^/subfolder/of/current/file.yml)}
Analogue to the <<
yaml syntax we can use <<<
to deep merge into the current nesting level.
This is helpful when merging files into already existing hierarchies.
Example:
data:
- list entry one
<<<:
- data:
- list entry two
- other: things
results in
data:
- list entry one
- list entry two
other: things
Define serverless.js
as
import path from 'path';
import minimist from 'minimist';
import { load } from 'yaml-boost';
const cfg = await load(path.join(__dirname, 'serverless.core.yml'), minimist(process.argv.slice(2)));
export default cfg;
Then instead of defining serverless.yml
, define your config in serverless.core.yml
.
FAQs
Yaml Parser with additional functionality.
We found that yaml-boost demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.