Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
config-heroku
Advanced tools
An adapter for using node-config (https://github.com/lorenwest/node-config) on heroku
An adapter for node-config that sticks configs in heroku env variables instead of reading from the FS.
add it to your package.json
, and use it exactly like node-config:
npm install --save config-heroku
var config = require('config-heroku')
As config-heroku is api compatible with config, you can just globally find & replace require('config')
with require('config-heroku')
to achieve heroku compatibility.
As you'll want a heroku specific config, add a heroku.json
file to your config
folder. It'll act like a production.json
, just only when it's up on heroku. You can add different ones if you want staging/prod setup (see Black Belt Usage below).
You'll need to set up the command line tool to package up your config - you can install it everywhere using:
npm install -g config-heroku
When you're ready to deploy, move the current config over to a heroku environment variable by runnning the save
command:
config-heroku save
You can now safely deploy to heroku and your config will be there.
Just in case you didn't want to run save
every time you update your config, node-config can auto-install a git hook that will take care of auto updating the variable:
hook add
Oops, you changed your mind? It's ok, config-heroku can clean up after itself:
hook remove
No more hook!
You're not convinced. What is the variable called? How does this work?
Don't worry, young grasshoper, here are answers:
By default, config-heroku will save it's info as JSON in a variable called "HEROKU_CONFIG".
When saving, config-heroku will read from config/heroku.json
(after inheriting default.json like node-config does) unless specified.
You can save and specify which config you'd like to save, using config-heroku save somename
. This will now save using the config/somename.json
file instead.
If you don't like the name HEROKU_CONFIG
, you can change that too. Just use config-heroku save somename MY_VARNAME
. Now you'll have a shiny new environment variable with your special config in it called MY_VARNAME
.
Config always defaults to looking for the HEROKU_CONFIG
variable. If you want to switch the current app to use something else, you can switch it using config-heroku use MY_VARNAME
. Now your app will use the MY_VARNAME
config instead of the HEROKU_CONFIG
one.
Now you've got a bunch of names to remember and your hook is broken. Don't worry, the hook
command accepts the same arguments as save
- you can simply config-heroku hook add somename MY_VARNAME
. Now when you commit, the MY_VARNAME
config is updated to the info in config/somename.json
.
Ok, smarty pants. Hit config-heroku
with no arguments and it'll spit out this info (you can also specify -h
or --help
, doesn't matter to me.):
Usage: config-heroku [options] [command]
Commands:
save [configname] [varname] [yes]
save closest found production config to heroku env. Var name defaults to "[configname]_CONFIG", configname defaults to "heroku", yes will always save.
hook [add] [configname] [varname]
adds or removes git hook to re-save configs with specified arguments to the nearest .git directory. Use "hook add or hook remove"
use [varname]
tell heroku which config variable to use.
Options:
-h, --help output usage information
That's all.
Github issues is a fine place to put bugs for this project if you find them.
Jesse Ditson
FAQs
An adapter for using node-config (https://github.com/lorenwest/node-config) on heroku
The npm package config-heroku receives a total of 5 weekly downloads. As such, config-heroku popularity was classified as not popular.
We found that config-heroku demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.