Research
Security News
Quasar RAT Disguised as an npm Package for Detecting Vulnerabilities in Ethereum Smart Contracts
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
@stamp/configure
Advanced tools
Access configuration of your stamps anywhere
Configuration is powerful feature of stamps as it allows you to store additional information with the stamp without interfering with properties or methods. Consider following example.
import compose from '@stamp/compose'
import jwt from 'jsonwebtoken'
const Jwt = compose({
configuration: {
jwtSecret: process.env.SECRET,
},
initializers: [
initializeJwt(_, { stamp }) {
const { jwtSecret } = stamp.compose.configuration
...
this.createJwtToken = (payload) => jwt.sign(payload, jwtSecret)
this.verifyJwtToken = (token) => jwt.verify(token, jwtSecret)
}
]
})
That approach brings several advantages.
The last bullet is especially useful for automated testing allowing you to insert different values based on various conditions. Unfortunately, there is apparent boilerplate hidden behind this, and it can get tedious for a larger project.
Now consider next example that is using @stamp/configure
stamp.
import Configure from '@stamp/configure'
import jwt from 'jsonwebtoken'
const Jwt = Configure.compose({
configuration: {
jwtSecret: process.env.SECRET,
},
methods: {
createJwtToken(payload) {
return jwt.sign(payload, this.config.jwtSecret)
},
verifyJwtToken(token) {
return jwt.verify(token, this.config.jwtSecret)
}
}
})
Looks good, doesn't it? But wait, all those advantages of the configuration are suddenly gone, right? Not exactly.
Under the hood, we are using @stamp/privatize
stamp. That allows us to access this.config
within our methods and yet keep them hidden from outside world. Immutability is ensured by using Object.freeze()
.
The deepConfiguration
gets assigned to the same this.config
object as well while the configuration
has a precedence over it. In case of name conflict, the value from configuration
always wins.
By including @stamp/configure
your whole stamp is privatized by default which you may not like that much. For that case, we are offering opt-out option of using Configure.noPrivatize()
instead of plain Configure
.
FAQs
Access configuration of your stamps anywhere
The npm package @stamp/configure receives a total of 0 weekly downloads. As such, @stamp/configure popularity was classified as not popular.
We found that @stamp/configure demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncover a malicious npm package posing as a tool for detecting vulnerabilities in Etherium smart contracts.
Security News
Research
A supply chain attack on Rspack's npm packages injected cryptomining malware, potentially impacting thousands of developers.
Research
Security News
Socket researchers discovered a malware campaign on npm delivering the Skuld infostealer via typosquatted packages, exposing sensitive data.