🚨 Shai-Hulud Strikes Again:834 Packages Compromised.Technical Analysis
Socket
Book a DemoInstallSign in
Socket

@kitschpatrol/shared-config

Package Overview
Dependencies
Maintainers
1
Versions
84
Alerts
File Explorer

Advanced tools

Socket logo

Install Socket

Detect and block malicious and high-risk dependencies

Install

@kitschpatrol/shared-config

A collection of shared configurations, linters, and formatting tools for TypeScript projects. All managed as a single dependency, and invoked via a single CLI command.

Source
npmnpm
Version
5.8.3
Version published
Weekly downloads
313
1322.73%
Maintainers
1
Weekly downloads
 
Created
Source

🔬 @kitschpatrol/shared-config

NPM Package @kitschpatrol/shared-config License: MIT

A collection of shared configurations, linters, and formatting tools for TypeScript projects. All managed as a single dependency, and invoked via a single CLI command.

Table of contents

Overview

This project consolidates most of the configuration and tooling shared by my open-source and internal TypeScript-based projects into a single dependency with a single CLI meta-command to lint and fix issues.

By installing @kitschpatrol/shared-config and then running ksc, you can run a half-dozen pre-configured code quality and linting tools in one shot. This spares you from cluttering your project's devDependencies with packages tangential to the task at hand.

If you don't plan to customize tool configurations, ksc init exposes an option to store references to each tool's shared configuration in your package.json instead of in files in your project root (at least where permitted by the tool). This can save a bit of file clutter in your project's root directory, at the expense of the immediate discoverability of the tools.

In addition, each tool exports a typed configuration factory function to simplify specifying and extending the default configuration.

The command name ksc is just an initialism for "Kitschpatrol Shared Configuration".

Tools

It takes care of dependencies, configuration, invocation, and reporting for the following tools:

  • ESLint (including Svelte, Astro, React, and TypeScript support — including type-checked rules)
  • Prettier (including a bunch of extra plugins)
  • Stylelint
  • TypeScript (including a shared TSConfig)
  • CSpell (bundled with a number of custom dictionaries, and a custom unused-word detector)
  • Case Police
  • Knip
  • VS Code (extension recommendations and extension settings)
  • Mdat (my markdown templating and expansion tool)
  • remarklint
  • Basic repo boilerplate (.npmrc, .gitignore, etc.)

Packages

This particular readme is for the @kitschpatrol/shared-config package, which depends on a number of tool-specific packages included in the kitschpatrol/shared-config monorepo on GitHub, each of which is documented in additional detail in its respective readme.

Primary package

Sub-packages

[!IMPORTANT]

Any of these packages may be installed and run on their own via CLI if desired. However, in general, the idea is to use @kitschpatrol/shared-config to easily run them all simultaneously over a repo with a single command with options to either check or (where possible) fix problems, with output aggregated into a single report.

Running ksc <command> calls the same command across the entire collection of sub-packages.

So assuming you've installed @kitschpatrol/shared-config...

Running:

ksc init

Is the same as running:

ksc-repo init
ksc-mdat init
ksc-typescript init
ksc-eslint init
ksc-stylelint init
ksc-cspell init
ksc-knip init
ksc-remark init
ksc-prettier init

(Sub-commands are always executed in the above order.)

The top-level ksc command also takes care of some nuances in terms of which sub-packages implement which commands, and which subcommands take arguments.

Getting started

Dependencies

Node >=20.19.0 is required, and pnpm >=10 is recommended. NPM and yarn might work as well, but I haven't tested them.

Installation

There are a few different ways to integrate @kitschpatrol/shared-config into your project, depending on whether you're starting from scratch or adding it to an existing project.

Create new project from a template:

The easiest way to get started is to create a new project from a starter template:

pnpm create @kitschpatrol/project@latest

See the template repository for more details.

Bootstrap from scratch:

Alternatively, this one-liner will bootstrap a new project and open it in VS Code, but the template approach above is preferred:

git init && pnpm init && pnpm pkg set type="module" && pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init && pnpm add -D @kitschpatrol/shared-config && pnpm ksc init && pnpm i && code .

Note that ksc init takes an optional --location package flag will put as much configuration in your package.json as possible instead of creating discrete config files in your project root for each tool. Putting config in package.json can save some clutter, but it makes configs less discoverable and can make it clunkier to extend or customize configurations since you don't have the benefit of type safety and autocomplete.

At any point, you can call ksc init again with the --location package or --location file flag to reinitialize your configuration files in one place or the other and restore the default configurations.

Add to an existing project:

This might overwrite certain config files, so commit first:

pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init && pnpm i && pnpm add -D @kitschpatrol/shared-config && pnpm ksc init

Step-by-step:

  • Install the requisite .npmrc:

    pnpm --package=@kitschpatrol/repo-config dlx ksc-repo init
    
  • Install the package:

    pnpm add -D @kitschpatrol/shared-config
    
  • Add default config files for all the tools to your project root:

    pnpm ksc init
    

    Or, if you don't plan to customize tool configurations, you might want to put as much config as possible under tool-specific keys in 'package.json':

    pnpm ksc init --location package
    
  • Add helper scripts to your package.json:

    These work a bit like npm-run-all to invoke all of the bundled tools.

    {
      "scripts": {
        "fix": "ksc fix",
        "lint": "ksc lint"
      }
    }
    
  • Set up GitHub action credentials (if desired)

    The GitHub actions included in @kitschpatrol/repo-config require permissions to create releases and update your repository metadata. You can add these through the GitHub website under the Settings → Secrets and variables → Actions page under the key PERSONAL_ACCESS_TOKEN, or with the GitHub CLI and a credential manager like 1Password CLI:

    gh secret set PERSONAL_ACCESS_TOKEN --app actions --body $(op read 'op://Personal/GitHub Mika/PERSONAL_ACCESS_TOKEN')
    

    See the @kitschpatrol/repo-config readme for more details.

Usage

Various VS Code plugins for the bundled tools should "just work".

To check / lint your entire project, after configuring the package.json as shown above:

pnpm run lint

To run all of the tools in a potentially destructive "fix" capacity:

pnpm run fix

CLI

Command: ksc

Run aggregated @kitschpatrol/shared-config commands.

This section lists top-level commands for ksc.

Usage:

ksc <command>
CommandArgumentDescription
initInitialize configuration files for the entire suite of @kitschpatrol/shared-config tools. Will use option flags where possible if provided, but some of the invoked tools will ignore them.
lint[files..]Lint your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
fix[files..]Fix your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
print-config[file]Print aggregated tool configuration data. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.
OptionDescriptionType
--help
-h
Show helpboolean
--version
-v
Show version numberboolean

See the sections below for more information on each subcommand.

Subcommand: ksc init

Initialize configuration files for the entire suite of @kitschpatrol/shared-config tools. Will use option flags where possible if provided, but some of the invoked tools will ignore them.

Usage:

ksc init
OptionDescriptionTypeDefault
--locationTK"file" "package""file"
--help
-h
Show helpboolean
--version
-v
Show version numberboolean

Subcommand: ksc lint

Lint your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.

Usage:

ksc lint [files..]
Positional ArgumentDescriptionTypeDefault
filesFiles or glob pattern to lint.array[]
OptionDescriptionType
--help
-h
Show helpboolean
--version
-v
Show version numberboolean

Subcommand: ksc fix

Fix your project with multiple tools in one go. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.

Usage:

ksc fix [files..]
Positional ArgumentDescriptionTypeDefault
filesFiles or glob pattern to fix.array[]
OptionDescriptionType
--help
-h
Show helpboolean
--version
-v
Show version numberboolean

Subcommand: ksc print-config

Print aggregated tool configuration data. Will use file arguments / globs where possible if provided, but some of the invoked tools only operate at the package-scope.

Usage:

ksc print-config [file]
Positional ArgumentDescriptionType
fileFile or glob pattern to TK.string
OptionDescriptionType
--help
-h
Show helpboolean
--version
-v
Show version numberboolean

Recall that the @kitschpatrol/shared-config package aggregates integration and invocation of the other tool-specific packages in this monorepo. Running a cli command on ksc effectively runs the same command against all the tool-specific packages.

Implementation notes

check vs lint

This project combines a mix of tools that regard their core task variously as "linting" or "checking" code and prose.

Across all the tools, I've chosen to use the term "lint" instead of "check" to refer to the read-only evaluation process.

Package architecture

Each package has a simple /src/cli.ts file which defines the behavior of its eponymous binary. The build step turns these into node "binary" scripts, providing default implementations where feasible.

The monorepo must be kept intact, as the sub-packages depend on scripts in the parent during build.

Hoisting caveats

The pnpm authors consider module hoisting harmful, and I tend to agree, but certain exceptions are carved out as necessary and accommodated via the .npmrc file included in @kitschpatrol/repo-config:

  • CSpell, remark, mdat, ESLint, and Prettier all need to be hoisted via public-hoist-pattern to be accessible in pnpm exec scripts and to VS Code plugins.

  • Even basic file-only packages like repo-config seem to need to be hoisted via for their bin scripts to be accessible via pnpm exec

  • In earlier version of pnpm, prettier and eslint packages were hoisted by default, but as of pnpm 10 this is no longer the case.

Development notes

The repo uses placeholders for the bin script for each tool to avoid circular dependency issues during pnpm install.

To tell git to ignore changes to the placeholders, run pnpm run bin-ignore.

For local development via pnpm, use file: dependency protocol instead of link:

Something to investigate: An approach to ignoring style rules in VS Code, and possibly migrate all style handling to ESLint instead of Prettier.

Background

Motivation

xo is really, really close to what I'm after here, but I wanted a few extra tools and preferred to use "first party" VS Code plugins where possible.

create-typescript-app is also excellent, and probably the best starting point for most people for most new projects. However, it does not take a "single top-level dependency" / "single unified CLI" approach.

antfu/eslint-config and @sxzz/eslint-config inspired the approach to ESLint integration.

Adjacent projects

License

MIT © Eric Mika

Keywords

shared-config

FAQs

Package last updated on 07 Nov 2025

Did you know?

Socket

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Install

Related posts