
Security News
/Research
Wallet-Draining npm Package Impersonates Nodemailer to Hijack Crypto Transactions
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
confederate
Advanced tools
Narrow road conf-loader suitable for confederates of apps (for instance suits of microserviceses). Dead simple story.
We wanted the init of apps tiny and tight. We wanted it aimed at suits of microservices.
Every app has a name configured in code. That's used for identification in logging, and for specific conf file - when needed. Confederate utilizes that. It also looks for a common conf. They're merged — with top-level keys granularity only. That's it. Because "fancy and elaborate" complex chains of inheritence, variable expansion and merging have avsolutely no place in app-confs at run-time. When you need that, you solve it in a conf-build stage. You want to catch problems at build time, not at deploy-time on server, with it's invariably differing setup compared to your dev-situation. Also, we all love yaml, etc — but again, that convenience saves no time in a deployed conf situation. For that: again, add a build-stage for the confs! Don't be lazy in the wrong places!
It's picky. Pass my-app --conf the-conf-dir
, my-app --conf=the-conf-dir
or CONF=the-conf-dir my-app
. A specific conf-file-path be passed instead of dir.
With the dir, it looks for "the-conf-dir/common-defaults.conf.json" and "the-conf-dir/the-app-name.conf.json" and merges them at top-level keys granularity only — yes, that's a feature — with the app-specific properties naturally taking precedence.
It's written in TypeScript for buildtime insurances.
More details to come — and changes. The goal is to reduce it to the least possible amount of code. Don't use this until v1.0.0, you've been warned.
FAQs
Narrow road conf-loader suitable for confederates of apps (for instance suits of microserviceses). Dead simple story.
The npm package confederate receives a total of 4 weekly downloads. As such, confederate popularity was classified as not popular.
We found that confederate demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
/Research
Malicious npm package impersonates Nodemailer and drains wallets by hijacking crypto transactions across multiple blockchains.
Security News
This episode explores the hard problem of reachability analysis, from static analysis limits to handling dynamic languages and massive dependency trees.
Security News
/Research
Malicious Nx npm versions stole secrets and wallet info using AI CLI tools; Socket’s AI scanner detected the supply chain attack and flagged the malware.