
Research
Malicious npm Packages Impersonate Flashbots SDKs, Targeting Ethereum Wallet Credentials
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
@stellarwp/mcp-node-config
Advanced tools
@stellarwp/mcp-node-config
)A lightweight configuration management library for CLI MCP servers with WordPress integration support.
This package provides a simple, type-safe way to manage environment-based configuration for MCP servers, with built-in WordPress-specific configuration validation and error handling.
# Install the package
bun add @stellarwp/mcp-node-config
# Or with npm
npm install @stellarwp/mcp-node-config
Copy the .env.example file in your project root and fill out the correct values for your environment:
WP_REST_URL=https://your-site.com/wp-json/wp/v2/
WP_USERNAME=your_username
WP_APP_PASSWORD=your_application_password
# Uncomment to disable SSL certificate verification for local server development. Should not be enabled on production!
# NODE_TLS_REJECT_UNAUTHORIZED=0
💡 Local Development Tip: When developing on a local environment where SSL certificates wouldn't validate (e.g., localhost with self-signed certs), you can set
NODE_TLS_REJECT_UNAUTHORIZED=0
in your environment variables. This is particularly important when using the API Fetch package to connect to local WordPress installations. Note: This should only be used in development environments, never in production.
#!/usr/bin/env node
// Import env first to load environment variables
import '@stellarwp/mcp-node-config/env';
import { config } from '@stellarwp/mcp-node-config';
// Check if configuration is valid
if (!config.isValid()) {
const missing = config.getMissingConfig();
throw new Error(`Missing required env vars: ${missing.join(', ')}`);
}
// Access configuration values
console.log('WordPress REST URL:', config.wpRestUrl);
console.log('Username:', config.wpUsername);
The config
object provides the following properties and methods:
wpRestUrl: string
- WordPress REST API base URLwpUsername: string
- WordPress username for authenticationwpAppPassword: string
- WordPress application passwordgetMissingConfig(): string[]
- Returns array of missing environment variable namesisValid(): boolean
- Returns true if all required configuration is presentVariable | Description | Required |
---|---|---|
WP_REST_URL | WordPress REST API base URL | Yes |
WP_USERNAME | WordPress username | Yes |
WP_APP_PASSWORD | WordPress application password | Yes |
NODE_TLS_REJECT_UNAUTHORIZED | Set to 0 for local development with invalid SSL certs | No |
FAQs
An MCP configuration library for Node.js
The npm package @stellarwp/mcp-node-config receives a total of 37 weekly downloads. As such, @stellarwp/mcp-node-config popularity was classified as not popular.
We found that @stellarwp/mcp-node-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Four npm packages disguised as cryptographic tools steal developer credentials and send them to attacker-controlled Telegram infrastructure.
Security News
Ruby maintainers from Bundler and rbenv teams are building rv to bring Python uv's speed and unified tooling approach to Ruby development.
Security News
Following last week’s supply chain attack, Nx published findings on the GitHub Actions exploit and moved npm publishing to Trusted Publishers.