
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
@staratlas/configs
Advanced tools
Shared configuration package for Star Atlas projects.
This package supports multiple toolchains (oxc, vite, typescript, plus legacy eslint/prettier exports), but you do not need to use all of it.
There are two different kinds of “size”:
Usage size (what your project actually imports/extends)Install size (what the package manager downloads)This package is a single npm package, so install-time contents are not tree-shaken.
What you can minimize very effectively is the usage surface by using subpath exports.
| You need | Install | Use |
|---|---|---|
| OXC lint + format only | @staratlas/configs oxlint oxfmt typescript | @staratlas/configs/oxc/oxlint-master.json + @staratlas/configs/oxc/oxfmt-master.json |
| OXC lint (React) | @staratlas/configs oxlint typescript | @staratlas/configs/oxc/oxlint-react.json |
| OXC lint (Next) | @staratlas/configs oxlint typescript | @staratlas/configs/oxc/oxlint-next.json |
| TypeScript base only | @staratlas/configs typescript | @staratlas/configs/base.json |
| TypeScript + Solid JSX | @staratlas/configs typescript | @staratlas/configs/base.json + @staratlas/configs/solid.json |
| Vite helpers (library/site config helpers) | @staratlas/configs vite typescript | @staratlas/configs/vite |
| Vite + Solid (OXC plugin) | @staratlas/configs vite typescript solid-js vite-plugin-solid-oxc solid-jsx-oxc vite-plugin-solid-svg | @staratlas/configs/vite + solidConfig() |
Notes:
@staratlas/configs is one package, so install-time contents are shared.Use only the subpaths you need instead of importing broad modules.
Use these files directly:
@staratlas/configs/oxc/oxlint-master.json@staratlas/configs/oxc/oxlint-react.json@staratlas/configs/oxc/oxlint-next.json@staratlas/configs/oxc/oxfmt-master.jsonExample package.json scripts:
{
"scripts": {
"lint": "oxlint -c ./node_modules/@staratlas/configs/oxc/oxlint-master.json .",
"format": "oxfmt --check -c ./node_modules/@staratlas/configs/oxc/oxfmt-master.json .",
"format:fix": "oxfmt -c ./node_modules/@staratlas/configs/oxc/oxfmt-master.json ."
}
}
If you are using React or Next, swap the lint config:
oxlint-react.jsonoxlint-next.jsonUse TS config subpaths only:
@staratlas/configs/base.json@staratlas/configs/solid.json (only if using Solid)Example tsconfig.json (library/app):
{
"extends": ["@staratlas/configs/base.json"],
"include": ["src"]
}
Example Solid project:
{
"extends": ["@staratlas/configs/base.json", "@staratlas/configs/solid.json"],
"include": ["src"]
}
Import only @staratlas/configs/vite:
import { combineConfigs, libConfig, cleanupConfig } from '@staratlas/configs/vite';
import type { UserConfig } from 'vite';
export default combineConfigs(
libConfig('src/index.ts'),
cleanupConfig(),
) satisfies UserConfig;
Solid (OXC plugin) example:
import { combineConfigs, libConfig, cleanupConfig, solidConfig } from '@staratlas/configs/vite';
import type { UserConfig } from 'vite';
export default combineConfigs(
libConfig('src/index.tsx'),
cleanupConfig(),
solidConfig({
solidPlugin: {
hydratable: true
}
}),
) satisfies UserConfig;
@staratlas/configs exposes multiple surfaces, but its peers are marked optional so you can install only the tools you actually run.
pnpm add -D @staratlas/configs oxlint oxfmt typescript
pnpm add -D @staratlas/configs vite typescript
Add Vite plugin peers only if you use helpers that need them.
pnpm add -D @staratlas/configs vite typescript solid-js vite-plugin-solid-oxc solid-jsx-oxc vite-plugin-solid-svg
Good:
@staratlas/configs/oxc/oxlint-master.json@staratlas/configs/base.json@staratlas/configs/viteAvoid (when unnecessary):
In a monorepo, only install Vite/Solid deps in frontend packages (or root if shared by policy). Backend/CLI packages can use only TS + OXC.
If a project must minimize dependency coupling, copy the exported JSON config into that repo and pin your own tool versions. You lose centralized updates, but gain maximum independence.
@staratlas/configs/oxc/oxlint-master.json (framework-neutral strict anti-tech-debt baseline)@staratlas/configs/oxc/oxlint-react.json (React + JSX a11y strict variant)@staratlas/configs/oxc/oxlint-next.json (Next strict variant)@staratlas/configs/oxc/oxfmt-master.json@staratlas/configs/base.json@staratlas/configs/solid.json@staratlas/configs/vite@staratlas/configs/eslint@staratlas/configs/prettierThese remain for compatibility. OXC is the default lint/format path for this package.
pnpm add -D @staratlas/configs oxlint oxfmt typescript
package.json
{
"scripts": {
"lint": "oxlint -c ./node_modules/@staratlas/configs/oxc/oxlint-master.json .",
"format": "oxfmt --check -c ./node_modules/@staratlas/configs/oxc/oxfmt-master.json .",
"format:fix": "oxfmt -c ./node_modules/@staratlas/configs/oxc/oxfmt-master.json ."
}
}
tsconfig.json
{
"extends": ["@staratlas/configs/base.json"],
"include": ["src"]
}
pnpm add -D @staratlas/configs vite typescript
vite.config.ts
import { cleanupConfig, combineConfigs, libConfig } from '@staratlas/configs/vite';
export default combineConfigs(libConfig('src/index.ts'), cleanupConfig());
This package itself is OXC-first:
pnpm lint -> oxlintpnpm format -> oxfmt --checkLegacy build/export surfaces (eslint, prettier) are still published for downstream compatibility.
FAQs
Shared configuration package for Star Atlas projects.
The npm package @staratlas/configs receives a total of 152 weekly downloads. As such, @staratlas/configs popularity was classified as not popular.
We found that @staratlas/configs demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 24 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.