Research
Security News
Kill Switch Hidden in npm Packages Typosquatting Chalk and Chokidar
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
@stamp/configure
Advanced tools
Access configuration of your stamps anywhere
Configuration is powerful feature of stamps as it allows you to store additional information with the stamp without interfering with properties or methods. Consider following example.
import compose from '@stamp/compose'
import jwt from 'jsonwebtoken'
const Jwt = compose({
configuration: {
jwtSecret: process.env.SECRET,
},
initializers: [
initializeJwt(_, { stamp }) {
const { jwtSecret } = stamp.compose.configuration
...
this.createJwtToken = (payload) => jwt.sign(payload, jwtSecret)
this.verifyJwtToken = (token) => jwt.verify(token, jwtSecret)
}
]
})
That approach brings several advantages.
The last bullet is especially useful for automated testing allowing you to insert different values based on various conditions. Unfortunately, there is apparent boilerplate hidden behind this, and it can get tedious for a larger project.
Now consider next example that is using @stamp/configure
stamp.
import Configure from '@stamp/configure'
import jwt from 'jsonwebtoken'
const Jwt = Configure.compose({
configuration: {
jwtSecret: process.env.SECRET,
},
methods: {
createJwtToken(payload) {
return jwt.sign(payload, this.config.jwtSecret)
},
verifyJwtToken(token) {
return jwt.verify(token, this.config.jwtSecret)
}
}
})
Looks good, doesn't it? But wait, all those advantages of the configuration are suddenly gone, right? Not exactly.
Under the hood, we are using @stamp/privatize
stamp. That allows us to access this.config
within our methods and yet keep them hidden from outside world. Immutability is ensured by using Object.freeze()
.
The deepConfiguration
gets assigned to the same this.config
object as well while the configuration
has a precedence over it. In case of name conflict, the value from configuration
always wins.
By including @stamp/configure
your whole stamp is privatized by default which you may not like that much. For that case, we are offering opt-out option of using Configure.noPrivatize()
instead of plain Configure
.
FAQs
Access configuration of your stamps anywhere
The npm package @stamp/configure receives a total of 13 weekly downloads. As such, @stamp/configure popularity was classified as not popular.
We found that @stamp/configure demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.
Product
Socket now supports uv.lock files to ensure consistent, secure dependency resolution for Python projects and enhance supply chain security.