
Research
/Security News
DuckDB npm Account Compromised in Continuing Supply Chain Attack
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
config-validation
Advanced tools
An config loader with type checking and resolver to defaults values
A library created with the objective to facilitate creating configs that are stored in JSON files. It's uses a schema defined by the user, that the loaded json file needs to have otherside the loading of the file will fail as an "Config error".
In the moment this library is in pre-release, so be careful when to use it. There can be lots of bugs or some problems that needs to be fixed.
An alternative of Convict written in Typescript, the primary reason of this library is the need of dynamically updating the configuration file in some of my projects (yeah, it has it's owns risk but I need to do it :/ and take care of all possible errors)
Setup an configuration file anywhere in your machine (be certain that the application can read the file), and use it's path in configurator
Example:
import { configurator } from "config-validation";
import path from 'path';
const Configurator = configurator({
databaseUrl: {
description: 'Database url',
type: 'string',
required: true,
},
insert_invertal: {
description: 'Bach insert interval used for buffer cleaning',
type: 'number',
required: true,
},
server: {
port: {
description: 'The server port',
type: 'number',
default: 3333,
}
}
});
// Load configs from the file config.json
Configurator.load(path.join(__dirname, 'config.json'));
console.log(Configurator.get('databaseUrl'));
// Update the config value
Configurator.set('databaseUrl', 'Another url')
console.log(Configurator.get('databaseUrl'));
// Write the config changes to the file
Configurator.updateConfigFile();
FAQs
An config loader with type checking and resolver to defaults values
We found that config-validation demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.
Product
Socket’s new Pull Request Stories give security teams clear visibility into dependency risks and outcomes across scanned pull requests.