
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
github.com/adnsv/confkit
A minimalist Go configuration library with transparent layering.
Confkit embraces simplicity over features. While other configuration libraries offer dozens of integrations, complex validation rules, and automatic reloading, confkit provides just the essentials:
server.port
, SERVER_PORT
, and server-port
are the same// See exactly what's happening
fmt.Printf("%+v\n", cfg.Layers) // It's just data
// Know where values come from
value, originalKey, sourceName, _ := cfg.Get("server.port")
// value="8080", originalKey="SERVER_PORT", sourceName="env"
Most configuration libraries are either too simple (just os.Getenv
) or too complex (hundreds of features you'll never use). Confkit sits in the sweet spot:
map[string]string
. Create them however you want.server.port
= SERVER_PORT
= server-port
Confkit doesn't parse files or connect to databases - it just manages string key-value pairs. This means it works seamlessly with whatever you're already using:
// From JSON/YAML/TOML files
var data map[string]any
json.Unmarshal(configBytes, &data)
cfg.Add(confkit.FromMap("config.json", data))
// From SQL databases
rows := db.Query("SELECT key, value FROM settings WHERE app = ?", appID)
cfg.Add(confkit.FromMap("database", sqlRowsToMap(rows)))
// From Redis, etcd, Consul
values := consul.GetAll("myapp/config")
cfg.Add(&confkit.Layer{Name: "consul", Values: values})
// From your custom API
settings := apiClient.GetSettings()
cfg.Add(confkit.FromMap("api", settings))
The flat map[string]string
design means confkit works with any storage system that can produce key-value pairs.
go get github.com/adnsv/confkit
// Define your configuration struct
type Config struct {
Server struct {
Port int `mapstructure:"port"`
Host string `mapstructure:"host"`
} `mapstructure:"server"`
}
// Create defaults using a function (testable, reusable)
func DefaultConfig() *Config {
return &Config{
Server: struct{
Port int `mapstructure:"port"`
Host string `mapstructure:"host"`
}{
Port: 8080,
Host: "localhost",
},
}
}
// Build configuration with clear precedence
cfg := confkit.NewConfig()
// Layer 1: Defaults
defaults := cfg.Add(confkit.FromDefaults("defaults", DefaultConfig()))
// Layer 2: Config file (you load it however you want)
configData := loadMyConfigFile() // Returns map[string]any
cfg.Add(confkit.FromMap("config.json", configData))
// Layer 3: Environment (highest precedence)
cfg.Add(confkit.FromEnv("env", "MYAPP_"))
// Use it - multiple ways
var config Config
cfg.Unmarshal(&config)
// Or get individual values with full visibility
port, originalKey, source, _ := cfg.Get("server.port")
fmt.Printf("Port %s came from %s (via %s)\n", port, source, originalKey)
// Runtime updates? Just modify the layer
defaults.Values["feature.newThing"] = "enabled"
Simple is harder than complex. Every feature in confkit must justify its existence without compromising the core simplicity.
Transparency over magic. You should be able to access your configuration state and understand it completely. No hidden state, no surprising behavior.
Composition over configuration. Confkit provides building blocks that combine into complete solutions. Start simple, add only what you need.
Strings are universal. Every system understands strings. Type conversion happens at the edges, not in the core.
MIT
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.