
Research
/Security News
PolinRider Spreads Through Compromised GitHub Accounts and Packagist
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.
⚡️ A fast, lightweight, easy-to-use, configuration files loader 📄
npm install coffi
import { loadConfig } from "coffi";
// Loads config from the first matching file extension (see priority list below)
const { config, filepath } = await loadConfig("app.config");
// Or specify custom extensions to search for (in priority order)
const { config } = await loadConfig("tsconfig", [".json"]);
The loader checks files in this order:
.ts files.mts files.cts files.js files.mjs files.cjs files.json filesYou can customize this order using the extensions option.
import { loadConfig } from "coffi";
import path from "node:path";
const { config } = await loadConfig({
name: "database.config",
extensions: [".js", ".json", ".ts"],
cwd: path.join(__dirname, "config"),
maxDepth: 1, // (set to 1 to search only in current directory)
preferredPath: "path/to/config.js", // Skip search and load from this path
packageJsonProperty: "myConfig", // Load configuration from package.json
});
The preferredPath option allows you to specify an exact file path to load, bypassing the normal file search process. When provided, coffi will directly load the configuration from this path.
The packageJsonProperty option allows you to load configuration directly from a property in your project's package.json file. When specified, coffi will look for a property with this name in the nearest package.json file, and if found, will use its value as the configuration. This takes precedence over all other configuration sources, making it convenient for projects where you prefer to keep configuration in package.json.
FAQs
đź“„ A fast, lightweight, easy-to-use, configuration files loader for Bun
We found that coffi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.

Company News
Allow myself to introduce... myself.