
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
@app-config/electron
Advanced tools
Exposes app-config values to Electron render processes
Easily inject app-config
values into Electron renderer processes. An example project is provided here.
yarn add @app-config/main @app-config/electron
Or, if you use NPM.
npm i @app-config/main @app-config/electron
app.whenReady().then(() => {
loadConfig().then(() => {
const mainWindow = new BrowserWindow();
mainWindow.loadFile('./index.html')
});
});
BrowserWindow
webPreferences
Pass your config and optionally any other BrowserWindow
webPreferences
you need to addAppConfigPreload
.
app.whenReady().then(() => {
loadConfig().then(() => {
const mainWindow = new BrowserWindow({
webPreferences: addAppConfigPreload(config),
});
mainWindow.loadFile('./index.html')
});
});
They can be found in window._appConfig
or in config
if using @app-config/main
in your web page (when using @app-config/webpack
with headerInjection
or @app-config/vite
with readGlobal
). It's also available in config
in the main Electron process.
Your app will need to be restarted to reflect any configuration changes.
Setting contextIsolation
to true
in the browserOptions
of your BrowserWindow
settings is required for this package to work. We set this for you, but if your app requres contextIsolation
to be false
using this package will break your app.
FAQs
Exposes app-config values to Electron render processes
The npm package @app-config/electron receives a total of 16 weekly downloads. As such, @app-config/electron popularity was classified as not popular.
We found that @app-config/electron demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.