
Product
Introducing Tier 1 Reachability: Precision CVE Triage for Enterprise Teams
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
devintent-figaro
Advanced tools
Simple configuration of sensitive information in open source projects
npm module to help on configuration of sensitive information on open source projects. This project is directly inspired by Figaro
$ npm install figaro -g
node figaro relies on creating a file (figaro.json) where you will store your sensitive information (passwords, secret keys, etc...) as key/value pairs The contents of this file can then be used in different environments by encrypting them with the environment public key.
The options that you can use with node figaro are:
From the root of your module (where your package.json lives):
$ figaro --setup
This will generate a figaro.json file and it will be added to your .gitignore In the figaro.json file you can add something like:
{ "PASSWORD": "SuperSecretPassword" }
Simply require figaro and run parse to import all the variables in figaro.json into your nodes environment.
figaro = require('figaro').parse(figaroJSONPath, callback); // figaroJSONPath can be null and in such case default location of figaro.json is used
You can encrypt the contents of figaro.json for later usage as environment variables in travis
$ figaro --travis
This will generate something like:
env:
- {secure: "df/EJcOiNPNpPn9i6Nr5cpH1OOYL0FYpXdIY8zpHh7LLfwJ5q4gIwAWSXjXC2NLk13Ki+HsBgph84PX0Bd4/8FCvw6FH8lgkBkjxjG5/tgJ9j8K733CtoxuvVwSMEJsyFEHU1r9JeNx4nyriTu6JhWRnTAYVLQJjhXEncXG4Fsc="}
You can add that to your .travis.yml file safely (it is encrypted using your module public key in travis, so only travis can decrypt it) And now in travis you will have an environment variable called PASSWORD with value SuperSecretPassword.
FAQs
Simple configuration of sensitive information in open source projects
We found that devintent-figaro demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Product
Socket’s new Tier 1 Reachability filters out up to 80% of irrelevant CVEs, so security teams can focus on the vulnerabilities that matter.
Research
/Security News
Ongoing npm supply chain attack spreads to DuckDB: multiple packages compromised with the same wallet-drainer malware.
Security News
The MCP Steering Committee has launched the official MCP Registry in preview, a central hub for discovering and publishing MCP servers.