
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
@carforyou/configuration
Advanced tools
It loads configuration for a specific stage via dotenv
from .env/<CONFIG_ENV>
. If no environment is provided it defaults to NODE_ENV
.
You can add local overrides in .env/<CONFIG_ENV>.local
. This is useful for temporary or local changes.
npm install @carforyou/configuration
Add the following line to your .gitignore
/.env/*.local
The configuration environment can be passed via CONFIG_ENV
environment variable:
$ CONFIG_ENV=stage-prod npm run dev
In a nextjs project, you can call loadConfiguration()
in next.config.js
and pass the result to next as env
, see https://nextjs.org/docs/api-reference/next.config.js/environment-variables - configuration values will be available on process.env
both client- and server-side
const configuration = require("@carforyou/configuration")
module.exports = {
env: configuration
}
In any node process, simply require the package in your entry point and access variables on process.env
. Do this as early in the file as possible, ie. before requiring any files that are accessing config variables
require("@carforyou/configuration")
npm run build
You can link your local npm package to integrate it with any local project:
cd carforyou-configuration-pkg
npm run build
cd carforyou-listings-web
npm link ../carforyou-configuration-pkg
New versions are released on the ci using semantic-release as soon as you merge into master. Please make sure your merge commit message adheres to the corresponding conventions.
You will need to enable the repository in circle CI ui to be able to build it.
For slack notifications to work you will need to provide the token in circle settings.
FAQs
CAR FOR YOU configuration conventions
The npm package @carforyou/configuration receives a total of 9 weekly downloads. As such, @carforyou/configuration popularity was classified as not popular.
We found that @carforyou/configuration demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.