Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
@bscotch/config
Advanced tools
A library of helper classes for modeling and managing configuration files, including tsconfig.json and package.json files.
Configuration file management can be a pain. This package contains a collection of helpers to make config management easier.
In the JavaScript/Typescript ecosystem, most configuration files are stored as JSON files.
ConfigFile
base classThis package provides a base ConfigFile
base class to make saving, loading, and typing JSON-based configuration files easier.
"extends"
fields.The following is a sample for how to create a custom config class using this package's base class.
import { ConfigFile, ConfigFileOptions } from '@bscotch/config';
interface MyConfigOptions {
someValue: string;
someOtherValue: { hello: number }[];
}
class MyConfigClass extends ConfigFile<MyConfigOptions> {
constructor(
options: Omit<ConfigFileOptions<MyConfigOptions>, 'defaultBaseName'>,
) {
super({ defaultBasename: 'my-config.json', ...options });
}
async cumulativeOptions() {
// Get all parsed config data, following
// "extends" fields, so that you can apply
// custom resolution logic.
const chain = await this.inheritenceChain();
const options = chain.reduce((cumulative, current) => {
Object.assign(cumulative, current);
return cumulative;
}, {});
return options;
}
}
// Load a config file (defaults to searching cwd)
const config = new ConfigFile<MyConfig>();
const options = await config.cumulativeOptions();
PackageJson
classThis package provides a PackageJson
class for working with package.json
files. It extends the ConfigFile
base class.
npm pack
file:
protocol.import { PackageJson } from '@bscotch/config';
// You can extend the PackageJson type with custom
// fields.
interface CustomFields {
myField: string;
myOtherField: { hello: number }[];
}
// Find the nearest package.json and load it
// (starts in cwd by default)
const pkg = await PackageJson.findPackageJson<CustomFields>();
// Check for a dependency
const tsDep = pkg.findDependency('typescript');
// -> {version: '^4.7.3', type: 'devDependencies'}
// Bump the version
await pkg.bumpVersion('minor');
TsConfig
classTypescript configuration options are specified with tsconfig.json
files. These files are loaded and used by a wide variety of tools, though any given tool may only support a subset of options or config versions.
The TsConfig
helper class provides utilities for various features that are useful for managing a Typescript project, mostly for simplifying the creation of tools that operate on Typescript projects.
"references"
.import { TsConfig } from '@bscotch/config';
// Find the nearest tsconfig.json file.
const mainConfig = await TsConfig.resolve();
// Get the cumulative config options, resulting
// from recursively following paths in the "extends" field.
const options = await mainConfig.cumulativeConfig();
// Get a list of all `tsconfig`s that are part of this
// project, by recursively following the paths found in
// the "references" field.
const configs = await mainConfig.resolveProjectReferenceTree();
FAQs
A library of helper classes for modeling and managing configuration files, including tsconfig.json and package.json files.
The npm package @bscotch/config receives a total of 19 weekly downloads. As such, @bscotch/config popularity was classified as not popular.
We found that @bscotch/config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.