
Research
Malicious npm Package Brand-Squats TanStack to Exfiltrate Environment Variables
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.
common-config
Advanced tools
Config store for values that are commonly needed by project scaffolders, like Generate or Yeoman.
Config store for values that are commonly needed by project scaffolders, like Generate or Yeoman.
(TOC generated by verb using markdown-toc)
It's common for build systems, project scaffolders and other applications to need certain basic information about the user. For example, author.name might be used for populating templates or commit messages, etc.
This library is an API and CLI for setting and getting these commonly needed values from a config store in the ~/.data-store/common-config directory.
Install globally with npm
$ npm install --global common-config
$ common-config --help
Usage: common-config <command> [value]
Commands:
--init, -i Initialize a prompt to store common values
--set, -s Save a value to the common-config store
--get, -g Show all values, or a specific value from the common-config store
--del, -d Delete a value from the common-config store
--help Display this menu
Initialize a prompt session to populate the store with default values:
$ common-config --init
Properties
Answers are used to populate the following properties on the config.data object:
author.nameauthor.usernameauthor.twitterauthor.urllicenseQuestions
To get the values, the following questions are asked:
Full name?: Your full name, saved to the author.name property.GitHub username?: Your GitHub username, saved to the author.username property.Twitter username?: Twitter username, saved to the author.twitter property.URL?: URL, saved to the author.url property.Preferred license?: Preferred license to use when initializing new projects. Saved to the license property.Install with npm:
$ npm install --save common-config
Add to your application using node.js require() system:
var config = require('common-config');
config.set('author.name', 'Jon Schlinkert');
config.set('author.username', 'jonschlinkert');
console.log(config.get('author.name'));
//=> 'Jon Schlinkert'
console.log(config.get('author.username'));
//=> 'jonschlinkert'
console.log(config.get('author'));
//=> {name: 'Jon Schlinkert', username: 'jonschlinkert'}
console.log(config.data);
//=> {author: {name: 'Jon Schlinkert', username: 'jonschlinkert'}}
See the unit tests for more examples.
You might also be interested in these projects:
Pull requests and stars are always welcome. For bugs and feature requests, please create an issue.
Install dev dependencies:
$ npm install -d && npm test
Jon Schlinkert
Copyright © 2016, Jon Schlinkert. Released under the MIT license.
This file was generated by verb, v0.9.0, on July 11, 2016.
FAQs
Config store for values that are commonly needed by project scaffolders, like Generate or Yeoman.
The npm package common-config receives a total of 21,261 weekly downloads. As such, common-config popularity was classified as popular.
We found that common-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A brand-squatted TanStack npm package used postinstall scripts to steal .env files and exfiltrate developer secrets to an attacker-controlled endpoint.

Research
Compromised SAP CAP npm packages download and execute unverified binaries, creating urgent supply chain risk for affected developers and CI/CD environments.

Company News
Socket has acquired Secure Annex to expand extension security across browsers, IDEs, and AI tools.