
Research
/Security News
Intercom’s npm Package Compromised in Ongoing Mini Shai-Hulud Worm Attack
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.
@config-dug/plugin-config-cat
Advanced tools
A ConfigCat plugin for Config Dug This plugin is used to support loading configuration values via the ConfigCat API: https://api.configcat.com/docs/
[!IMPORTANT] The ConfigCat SDK key name will be specified within the plugin parameters. This sdk key value will need to be loaded from the environment variables in order to be used in this plugin.
const configCatPlugin = new ConfigCatPlugin({
sdkKeyName: 'CONFIG_CAT_SDK_KEY',
sourceKeyStyle: 'SCREAMING_SNAKE_CASE',
targetedFlags: [
{
key: 'value1',
defaultValue: false,
},
{
key: 'value2',
defaultValue: 'test default',
},
],
});
| Parameter | Type | Description |
|---|---|---|
sdkKeyName | string | The name of the sdk key parameter to be loaded from environment variables. |
sourceKeyStyle | number | The naming convention used by the plugin source. ex. SCREAMING_SNAKE_CASE |
targetedFlags | array | The definition of all targeted flags to be loaded by the plugin. |
[!IMPORTANT] The ConfigCat plugin exports a custom type
targetedConfigCatFlagSchemaThat can be used to define targeted flags within the schema. This is a custom zod definition that matches function definition returned by this plugin and should be used for all targeted flags.
const schema = {
CONFIG_CAT_SDK_KEY: z.string(),
value1: {
schema: targetedConfigCatFlagSchema,
description: 'Targeted ConfigCat config boolean',
sensitive: false,
},
};
The ConfigCat plugin can be added to the plugins array in config dug constructor. Keep in mind the plugin load order dictates which values will be used.
const configDug = new ConfigDug(schema, {
plugins: [configCatPlugin],
printConfig: true,
});
const schema = {
CONFIG_CAT_SDK_KEY: z.string(),
value1: {
schema: z.string(),
description: 'Non-targeted ConfigCat string',
sensitive: false,
},
value2: {
schema: targetedConfigCatFlagSchema,
description: 'Targeted ConfigCat value',
sensitive: true,
},
};
const configCatPlugin = new ConfigCatPlugin({
sdkKeyName: 'CONFIG_CAT_SDK_KEY',
sourceKeyStyle: 'SCREAMING_SNAKE_CASE',
targetedFlags: [
{
key: 'value1',
defaultValue: false,
},
{
key: 'value2',
defaultValue: 'test default',
},
],
});
const configDug = new ConfigDug(schema, {
plugins: [configCatPlugin],
printConfig: true,
});
await configDug.load();
const config = configDug.getConfig();
console.log(config.value1); // returns a string value from ConfigCat
console.log(await config.value2({ identifier: 'Some Id Value' })); // returns the targeted flag response
FAQs
A ConfigCat plugin for Config Dug
The npm package @config-dug/plugin-config-cat receives a total of 9 weekly downloads. As such, @config-dug/plugin-config-cat popularity was classified as not popular.
We found that @config-dug/plugin-config-cat demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Compromised intercom-client@7.0.4 npm package is tied to the ongoing Mini Shai-Hulud worm attack targeting developer and CI/CD secrets.

Research
Socket detected a malicious supply chain attack on PyPI package lightning versions 2.6.2 and 2.6.3, which execute credential-stealing malware on import.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.