
Research
/Security News
Fake imToken Chrome Extension Steals Seed Phrases via Phishing Redirects
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.
c12 (pronounced as /siːtwelv/, like c-twelve) is a smart configuration loader.
.js, .ts, .mjs, .cjs, .mts, .cts .json config loader with unjs/jiti.jsonc, .json5, .yaml, .yml, .toml config loader with unjs/confbox.config/ directory support (config dir proposal).rc config support with unjs/rc9.env support with dotenvpackage.json fileInstall package:
# ✨ Auto-detect
npx nypm install c12
Import:
// ESM import
import { loadConfig, watchConfig } from "c12";
// or using dynamic import
const { loadConfig, watchConfig } = await import("c12");
Load configuration:
// Get loaded config
const { config } = await loadConfig({});
// Get resolved config and extended layers
const { config, configFile, layers } = await loadConfig({});
c12 merged config sources with unjs/defu by below order:
package.jsoncwdResolve configuration from this working directory. The default is process.cwd()
nameConfiguration base name. The default is config.
configFileConfiguration file name without extension. Default is generated from name (f.e., if name is foo, the config file will be => foo.config).
rcFileRC Config file name. Default is generated from name (name=foo => .foorc).
Set to false to disable loading RC config.
globalRcLoad RC config from the workspace directory and the user's home directory. Only enabled when rcFile is provided. Set to false to disable this functionality.
dotenvLoads .env file when true or an options object is passed. It is disabled by default.
Supports loading multiple files that extend eachother in left-to-right order when a fileNames array of relative/absolute paths is passed in the options object.
Example:
# .env
CONNECTION_POOL_MAX="10"
DATABASE_URL="<...rds...>"
# .env.local
DATABASE_URL="<...localhost...>"
export default {
connectionPoolMax: process.env.CONNECTION_POOL_MAX,
databaseURL: process.env.DATABASE_URL,
};
import { loadConfig } from "c12";
const config = await loadConfig({
dotenv: {
fileName: [".env", ".env.local"],
},
});
console.log(config.config.connectionPoolMax); // "10"
console.log(config.config.databaseURL); // "<...localhost...>"
packageJsonLoads config from nearest package.json file. It is disabled by default.
If true value is passed, c12 uses name field from package.json.
You can also pass either a string or an array of strings as a value to use those fields.
defaultsSpecify default configuration. It has the lowest priority and is applied after extending config.
defaultConfigSpecify default configuration. It is applied before extending config.
overridesSpecify override configuration. It has the highest priority and is applied before extending config.
omit$KeysExclude environment-specific and built-in keys start with $ in the resolved config. The default is false.
jitiCustom unjs/jiti instance used to import configuration files.
jitiOptionsCustom unjs/jiti options to import configuration files.
gigetOptions passed to unjs/giget when extending layer from git source.
mergerCustom options merger function. Default is defu.
Note: Custom merge function should deeply merge options with arguments high -> low priority.
envNameEnvironment name used for environment specific configuration.
The default is process.env.NODE_ENV. You can set envName to false or an empty string to disable the feature.
contextContext object passed to dynamic config functions.
resolveYou can define a custom function that resolves the config.
configFileRequiredIf this option is set to true, loader fails if the main config file does not exists.
If resolved config contains a extends key, it will be used to extend the configuration.
Extending can be nested and each layer can extend from one base or more.
The final config is merged result of extended options and user options with unjs/defu.
Each item in extends is a string that can be either an absolute or relative path to the current config file pointing to a config file for extending or the directory containing the config file.
If it starts with either github:, gitlab:, bitbucket:, or https:, c12 automatically clones it.
For custom merging strategies, you can directly access each layer with layers property.
Example:
// config.ts
export default {
colors: {
primary: "user_primary",
},
extends: ["./theme"],
};
// config.dev.ts
export default {
dev: true,
};
// theme/config.ts
export default {
extends: "../base",
colors: {
primary: "theme_primary",
secondary: "theme_secondary",
},
};
// base/config.ts
export default {
colors: {
primary: "base_primary",
text: "base_text",
},
};
The loaded configuration would look like this:
const config = {
dev: true,
colors: {
primary: "user_primary",
secondary: "theme_secondary",
text: "base_text",
},
};
Layers:
[
{
config: {
/* theme config */
},
configFile: "/path/to/theme/config.ts",
cwd: "/path/to/theme ",
},
{
config: {
/* base config */
},
configFile: "/path/to/base/config.ts",
cwd: "/path/to/base",
},
{
config: {
/* dev config */
},
configFile: "/path/to/config.dev.ts",
cwd: "/path/",
},
];
You can also extend configuration from remote sources such as npm or github.
In the repo, there should be a config.ts (or config.{name}.ts) file to be considered as a valid config layer.
Example: Extend from a github repository
// config.ts
export default {
extends: "gh:user/repo",
};
Example: Extend from a github repository with branch and subpath
// config.ts
export default {
extends: "gh:user/repo/theme#dev",
};
Example: Extend a private repository and install dependencies:
// config.ts
export default {
extends: ["gh:user/repo", { auth: process.env.GITHUB_TOKEN, install: true }],
};
You can pass more options to giget: {} in layer config or disable it by setting it to false.
Refer to unjs/giget for more information.
Users can define environment-specific configuration using these config keys:
$test: {...}$development: {...}$production: {...}$env: { [env]: {...} }c12 tries to match envName and override environment config if specified.
Note: Environment will be applied when extending each configuration layer. This way layers can provide environment-specific configuration.
Example:
export default {
// Default configuration
logLevel: "info",
// Environment overrides
$test: { logLevel: "silent" },
$development: { logLevel: "warning" },
$production: { logLevel: "error" },
$env: {
staging: { logLevel: "debug" },
},
};
you can use watchConfig instead of loadConfig to load config and watch for changes, add and removals in all expected configuration paths and auto reload with new config.
onWatch: This function is always called when config is updated, added, or removed before attempting to reload the config.acceptHMR: By implementing this function, you can compare old and new functions and return true if a full reload is not needed.onUpdate: This function is always called after the new config is updated. If acceptHMR returns true, it will be skipped.import { watchConfig } from "c12";
const config = watchConfig({
cwd: ".",
// chokidarOptions: {}, // Default is { ignoreInitial: true }
// debounce: 200 // Default is 100. You can set it to false to disable debounced watcher
onWatch: (event) => {
console.log("[watcher]", event.type, event.path);
},
acceptHMR({ oldConfig, newConfig, getDiff }) {
const diff = getDiff();
if (diff.length === 0) {
console.log("No config changed detected!");
return true; // No changes!
}
},
onUpdate({ oldConfig, newConfig, getDiff }) {
const diff = getDiff();
console.log("Config updated:\n" + diff.map((i) => i.toJSON()).join("\n"));
},
});
console.log("watching config files:", config.watchingFiles);
console.log("initial config", config.config);
// Stop watcher when not needed anymore
// await config.unwatch();
[!NOTE] This feature is experimental
Update or create a new configuration files.
Add magicast peer dependency:
# ✨ Auto-detect
npx nypm install -D magicast
Import util from c12/update
const { configFile, created } = await updateConfig({
cwd: ".",
configFile: "foo.config",
onCreate: ({ configFile }) => {
// You can prompt user if wants to create a new config file and return false to cancel
console.log(`Creating new config file in ${configFile}...`);
return "export default { test: true }";
},
onUpdate: (config) => {
// You can update the config contents just like an object
config.test2 = false;
},
});
console.log(`Config file ${created ? "created" : "updated"} in ${configFile}`);
You can use a function to define your configuration dynamically based on context.
// config.ts
export default (ctx) => {
return {
apiUrl: ctx?.dev ? "http://localhost:3000" : "https://api.example.com",
};
};
// Usage
import { loadConfig } from "c12";
const config = await loadConfig({
context: { dev: true },
});
Published under the MIT license.
Made by @pi0 and community 💛
🤖 auto updated with automd
The 'config' package is a popular configuration management tool for Node.js applications. It allows you to define configurations for different environments and load them based on the current environment. Compared to c12, 'config' is more opinionated and structured, making it easier to manage complex configurations but less flexible in terms of merging and loading from multiple sources.
The 'dotenv' package loads environment variables from a .env file into process.env. It is simpler and more focused compared to c12, which offers more comprehensive configuration management capabilities including merging configurations from multiple sources.
The 'rc' package is a non-opinionated configuration loader that reads configuration from various sources like files, environment variables, and command-line arguments. It is similar to c12 in terms of flexibility but lacks some of the advanced features like merging configurations and handling defaults and overrides.
FAQs
Smart Config Loader
The npm package c12 receives a total of 9,040,680 weekly downloads. As such, c12 popularity was classified as popular.
We found that c12 demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Mixed-script homoglyphs and a lookalike domain mimic imToken’s import flow to capture mnemonics and private keys.

Security News
Latio’s 2026 report recognizes Socket as a Supply Chain Innovator and highlights our work in 0-day malware detection, SCA, and auto-patching.

Company News
Join Socket for live demos, rooftop happy hours, and one-on-one meetings during BSidesSF and RSA 2026 in San Francisco.