
Security News
Happy Birthday, Shai-Hulud
It has been one year since Shai-Hulud made its first appearance on npm.
⚡️ A fast, lightweight, easy-to-use, configuration files loader 📄
npm install coffi
import { loadConfig } from "coffi";
// Loads config from the first matching file extension (see priority list below)
const { config, filepath } = await loadConfig("app.config");
// Or specify custom extensions to search for (in priority order)
const { config } = await loadConfig("tsconfig", [".json"]);
The loader checks files in this order:
.ts files.mts files.cts files.js files.mjs files.cjs files.json filesYou can customize this order using the extensions option.
import { loadConfig } from "coffi";
import path from "node:path";
const { config } = await loadConfig({
name: "database.config",
extensions: [".js", ".json", ".ts"],
cwd: path.join(__dirname, "config"),
maxDepth: 1, // (set to 1 to search only in current directory)
preferredPath: "path/to/config.js", // Skip search and load from this path
packageJsonProperty: "myConfig", // Load configuration from package.json
});
The preferredPath option allows you to specify an exact file path to load, bypassing the normal file search process. When provided, coffi will directly load the configuration from this path.
The packageJsonProperty option allows you to load configuration directly from a property in your project's package.json file. When specified, coffi will look for a property with this name in the nearest package.json file, and if found, will use its value as the configuration. This takes precedence over all other configuration sources, making it convenient for projects where you prefer to keep configuration in package.json.
FAQs
📄 A fast, lightweight, easy-to-use, configuration files loader for Bun
The npm package coffi receives a total of 7,123 weekly downloads. As such, coffi popularity was classified as popular.
We found that coffi demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.

Security News
It has been one year since Shai-Hulud made its first appearance on npm.

Research
/Security News
Operators behind PolinRider used a compromised GitHub account to plant malware in four development versions of a Packagist package with 700,000+ downloads.

Security News
GitHub Actions now supports cache-mode, a least-privilege control on the Actions cache aimed at the cache poisoning technique behind recent compromises.