
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@apparts/config
Advanced tools
#+TITLE: @apparts/config #+DATE: [2019-02-07 Thu] #+AUTHOR: Philipp Uhl
This package can read configuration from environment variables, or, if not found in, from the folder =config= in the root-directory of the project.
** As environment variable
Storage in an environment variable can be done in two ways:
** From a folder when running in a Node environment
To require a configuration that is stored in one of the files
** Webpack for web environment
To require a configuration that is stored in the environment variable =MY_COLOR= (note, a dash becomes an underscore and everything is in uppercase): #+BEGIN_SRC sh const Colors = require('apparts-config').get('my-color'); #+END_SRC
In order to create environment variables use the following webpack (v
2.0) configuration options:
#+BEGIN_SRC js module.exports = env => { return { plugins: [ new webpack.DefinePlugin({ 'process.env': { 'MY_COLOR': JSON.stringify(JSON.stringify(require('./src/utils/colors.js'))) } }), ] } }; #+END_SRC
** React environment
In an react environment, you must call at the beginning of your application the following code. That ensures, that @apparts/config can access the environment variables.
#+BEGIN_SRC js import { setEnv } from "@apparts/config"; setEnv(process.env); #+END_SRC
Your config variables need to be stored in the =.env= file, with all config names prefixed with =REACT_APP_= or =VITE_=.
E.g. to get the config =my-color= you must store =REACT_APP_MY_COLOR= in your =.env= file. You can store the values as raw string or base64 encoded.
FAQs
A config-loading framework
We found that @apparts/config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.