Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
A standardized way to get configuration into your script using Etcd, environment vars and command line arguments
I was searching for a clear, simple, standardized and portable way to import config into projects, and to my surprise I couldn't find anything like that. So, I'm working on creating a collection of modules or includes for various languages I work in, in order to standardize the way that things are done.
Languages Config-EEC has been released in:
By using this module, variables are read from three sources, in this order:
Variables are overridden if they are redefined during that order. Meaning that if variable "port" is defined in Etcd, it can be overridden by ENV, and both Etcd and ENV can be overridden by command line argument. The key format is standardized, as to further reduce guesswork. Etcd keys are pretended by namespace, and are "lower-kebab-case". Environment variables are are prepended by namespace, and are "UPPER_SNAKE_CASE". Command line arguments are "lower-kebab-case", starting with "--". The Config-EEC module returns all keys as "camelCase", normalizing how config appears in code.
var configEEC = require('config-eec');
var configEECSetup = {
etcdNameSpace: 'cfg/web-service/',
envNameSpace: 'WEBSVC'
};
// Config is returned in callback
var config = {};
configEEC.load(configEECSetup, function (err, configNew) {
if (err) {
console.error('Configuration load error.', err);
process.exit();
}
config = configNew;
//
// Configuration loaded, continue project code...
//
});
// Watch for config changes
configEEC.watch(function (err, configNew) {
if (!err) {
console.log('Configuration has been updated.');
config = configNew;
}
});
Config is now available to project in three different formats:
Etcd key | Env key | CLI key | Code result |
---|---|---|---|
cfg/web-service/port | WEBSVC_PORT | --port | config.port |
cfg/web-service/server-name | WEBSVC_SERVER_NAME | --server-name | config.serverName |
cfg/web-service/max-connects | WEBSVC_MAX_CONNECTS | --max-connects | config.maxConnects |
cfg/web-service/time-out-ms | WEBSVC_TIME_OUT_MS | --time-out-ms | config.timeOutMs |
# Assuming Etcd has all of the above keys configured,
# they can be overridden by ENV by doing:
export WEBSVC_MAX_CONNECTS=100
export WEBSVC_SERVER_NAME="New staging server"
node someScript.js
# And they can be overridden again by using CLI arguments:
node someScript.js --max-connects=50 --server-name="Test server"
The configuration is now agnostic of the language of the script/service. The example above could have been PHP, Python or Node.js, being configured the same way.
ETCD_CONN
, defaulting to http://localhost:2379
.FAQs
A standardized way to get configuration into your script using Etcd, environment vars and command line arguments
The npm package config-eec receives a total of 0 weekly downloads. As such, config-eec popularity was classified as not popular.
We found that config-eec demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.