
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
@0disoft/universal-config-engine-node
Advanced tools
Node.js JSON file, dotenv file, process env, and argv sources for Universal Config Engine.
Bounded Node.js source adapters for Universal Config Engine. The package provides JSON file, simple dotenv file, process environment, and argv sources while keeping filesystem and process APIs outside the core package.
npm install @0disoft/universal-config-engine-core @0disoft/universal-config-engine-node
Node.js >=24 and ESM are required.
import { resolveConfig } from "@0disoft/universal-config-engine-core";
import { createProcessEnvSource } from "@0disoft/universal-config-engine-node";
const envSource = createProcessEnvSource({
descriptor: {
id: "env",
kind: "process-env",
priority: 20,
displayName: "environment"
},
env: process.env,
mappings: [
{
externalName: "APP_PORT",
sourceKind: "process-env",
targetPath: ["service", "port"],
parseAs: "number"
}
]
});
const result = resolveConfig({ sources: [envSource] });
console.log(result.config.service.port);
loadJsonFileSource and loadDotenvFileSource enforce byte limits. Set
allowedRootPath to bind file loading to a canonical directory; the loader verifies
the opened file identity before reading it. The dotenv parser is intentionally
simple and does not perform shell expansion.
Process-env and argv adapters use explicit mappings and bounded entry counts. Strict unmapped-input diagnostics are opt-in.
See the compatibility contract and public API contract.
MIT
FAQs
Node.js JSON file, dotenv file, process env, and argv sources for Universal Config Engine.
The npm package @0disoft/universal-config-engine-node receives a total of 12 weekly downloads. As such, @0disoft/universal-config-engine-node popularity was classified as not popular.
We found that @0disoft/universal-config-engine-node demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.