
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
@colucom/osseus-config
Advanced tools
The osseus configuration module parses:
The result is an object which will be used by other osseus modules.
Note: all keys will be lowercased in the result object
$ npm install @colucom/osseus-config
First, create index.js
:
const OsseusConfig = require('osseus-config')
const config = await OsseusConfig.init()
console.log(config)
You can use the hostInfo
property in the osseus.config object.
In case your app is running on:
hostname
is the machine namehostname
is the instance idThese props can be accessed by:
osseus.config.hostInfo.hostname
and osseus.config.hostInfo.pid
Environment variables must have a CFG_
prefix in order to be parsed by osseus-config
Running:
$ export CFG_SOME_VAR=value
$ node index.js
Will result in:
{ some_var: 'value', keys: [ 'some_var' ] }
Environment files should be placed under /config
folder in the root of the application.
In order for environment files to be parsed, need to define ENV
variable matching the file name.
Create /config/LOCAL.js
module.exports = {
DEBUG: true,
OSSEUS_LOGGER_LOG_LEVEL: 'debug',
OSSEUS_SERVER_PORT: '8888'
}
Running:
$ export CFG_ENV=LOCAL
$ node index.js
Will result in:
{ env: 'LOCAL',
debug: true,
osseus_logger: { log_level: 'debug' },
osseus_server: { port: 8888 },
keys: [ 'env', 'debug', 'osseus_logger', 'osseus_server' ] }
Note that keys starting with "osseus_" are broken into objects, more on this later
In order to use AWS Secrets need to define the following variables:
ENV
(or CFG_ENV
)
APPLICATION_NAME
(or CFG_APPLICATION_NAME
)
AWS_SECRETS_ENDPOINT
(or CFG_AWS_SECRETS_ENDPOINT
)
https://secretsmanager.eu-west-1.amazonaws.com
AWS_REGION
(or CFG_AWS_REGION
)
eu-west-1
When all relevant variables are defined, the secrets file names should be ENV/APPLICATION_NAME_*
Another secrets file which will be parsed if exists is ENV/GLOBAL_*
Running:
$ export CFG_ENV=QA
$ export CFG_APPLICATION_NAME=MY_APP
$ node index.js
Will look for QA/MY_APP_*
and QA/GLOBAL_*
in AWS secrets manager and add the keys to the config result object.
osseus-config
is using yargs to parse CLI arguments.
Running:
$ node index.js --PARAM_1 hello --PARAM_2 123 --PARAM_3 ["'something'"]
Will result in:
{ param_1: 'hello',
param_2: 123,
param_3: [ 'something' ],
keys: [ 'param_1', 'param_2', 'param_3' ] }
Create /config/LOCAL.js
module.exports = {
MY_PARAM: from_file
}
Running:
$ export CFG_ENV=LOCAL
$ export CFG_MY_PARAM=from_env
$ node index.js --MY_PARAM from_cli
Will result in:
{ my_param: 'from_cli',
env: 'LOCAL',
keys: [ 'my_param', 'env' ] }
Please see contributing guidelines.
Code released under the MIT License.
FAQs
Osseus config
We found that @colucom/osseus-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 6 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.