Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
A flexible configuration module. It reads .js
and .json
files by default,
but it can also be extended to read any filetype (such as .yaml
, or .cson
)
As of version 2.x
there was a major rewrite. Super breaking changes. The if
you were using the old version, the latest 1.x
version is 1.4.0
.
$ npm install configly --save
In the first(ish) file that runs in your project, use this:
var path = require('path');
var config = require('configly').setConfig(path.join(__dirname, 'config'));
That will read all of the files directly under your project's config/
directory (it will not ready files within directories).
Environment specific configuration is split between different files. The naming
convention used is hard-coded (for now). It is as such:
env.[environment name].extension
. The default environment is development
so
you should have an env.development.js
that exports an object. You can use json
or any other extension you activate. Then to use a different config environment,
Use the NODE_ENV=[environment name]
before you node index
or whatever.
Any other file that isn't an environment config file will always be included as
is. The filename should be all lowercase with words separated by hyphens, dots,
or underscores, because the name will be transformed into camelCase. For
example, if you have a config file called express-config.js
, it will be
attached to your configuration as expressConfig
.
Then if your subsequent files that get loaded:
var config = require('configly').config;
config.get('env.port');
config.get('user.email');
To add a filetype, use this when you initially setup the configuration.
var yaml = require('yaml');
var fs = require('fs');
var configPath = require('path').join(__dirname, 'config');
var config = require('configly').setConfig(configPath, {
parsers: {
yaml: function (filepath) {
return yaml.eval(fs.readFileSync(filepath, 'utf-8'));
}
}
});
Now all of your .yaml
files will be included.
Imagine a directory structure like this:
project/
├─ config/
│ ├─ env.development.json
│ ├─ env.production.json
│ ├─ user-permissions.json
│ └─ email.js
├─ node_modules/
│ └─ configly/...
├─ package.json
└─ app.js
config/env.development.json
{
"port": "3000",
"cachAge": 0
}
config/env.production.json
{
"port": "80",
"cacheAge": 86000
}
config/user-permissions.json
{
"/": [
"admin",
"anonymous"
],
"/admin": [
"admin"
]
}
config/email.js
'use strict';
var emailConfig = {};
emailConfig.user = 'email@email.com';
emailConfig.password = 'my super secure password';
module.exports = emailConfig;
app.js
'use strict';
var path = require('path');
var config = require('configly').setConfig(path.join(__dirname, 'config'));
console.log(config.get());
Alright, now with that setup, we run this command:
$ node app
We get this output:
{ email:
{ user: 'email@email.com',
password: 'my super secure password' },
env: { port: '3000', cachAge: 0},
userPermissions: { '/': [ 'admin', 'anonymous' ], '/admin': [ 'admin' ] } }
But when we run this command:
$ NODE_ENV=production node app
We get this output:
{ email:
{ user: 'email@email.com',
password: 'my super secure password' },
env: { port: '80', cacheAge: 86000},
userPermissions: { '/': [ 'admin', 'anonymous' ], '/admin': [ 'admin' ] } }
Notice the only change was in the environment variable. I don't know about you, but this is super handy, because now deployment becomes a breeze.
Any file you add to the config
directory will automatically be added to the
config object. No need to include it in some master config file.
Also, no 3rd party dependencies. The only core dependencies it has are fs
and
path
.
If there is some behavior that isn't expected, like the config object isn't
in the format you expected, try console.log
on the config object.
Any other issues, please report to this repo's issues on GitHub. If you can reproduce it, try to write a test that makes the tests fail with your use case and submit a pull request.
FAQs
A developer-friendly lightweight replacement for the 'config' module that works with custom config directories and pluggable parsers
The npm package configly receives a total of 411 weekly downloads. As such, configly popularity was classified as not popular.
We found that configly demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.