Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Simplistic env var parser inspired by mongoose schema
# Using npm
$ npm install envoose
# Or using yarn
$ yarn add envoose
// config.js
const envoose = require('envoose')
const configSchema = {
MONGO_URI: { required: true },
REQUEST_TIMEOUT: { type: Number, default: 1000 },
EXPIRY_DATE: { type: Date },
BOOLEAN_VAL: { type: Boolean },
CUSTOM_VAR: { env: 'CUSTOM_ENV_VAR' },
LIST: { type: s => s.split(',').map(Number) },
ENUM_VALID: { type: String, enum: ['A', 'B', 'C'] },
MATCH_VALID: { type: String, match: /.*match.*/g },
CUSTOM_VALID: { type: Number, validator: x => x !== 10 }
// INVALID_MIX: { required: true, default: 10 }
}
const config = envoose.getConfig(configSchema)
module.exports = config
Validate and load configs object using configSchema
A configSchema is an object that tells envoose which env vars to load and how to load them, in its most basic form, it's just a set of keys to load
const configSchema = {
FIRST_KEY: {},
SECOND_KEY: {}
}
A required key must be supplied through env vars. If the value is not available in process.env
, getConfig
will throw ConfigValidationError
.
Note that default
and required
can't be combined.
A value to fallback to if the env var is not set.
By default the config is read from env var with the same name as the config name. If env
is supplied, it will read from that env var instead.
Env vars are strings by default, however envoose allows you to cast them to different data types.
String
(default)Number
Date
Boolean
('true', 'yes', '1' evaluate to true, while 'false', 'no', '0' evaluate to false, CastError
will be thrown otherwise)s => s.split(',').map(Number)
)Built in validator that checks whether the value falls in one of the values in the list. Throws ConfigValidationError
if not found in enum.
Built in validator that checks whether the value matches this regex or not. Throws ConfigValidationError
if not matched.
Accepts custom validation function that should return true if valid and false otherwise.
FAQs
Simplistic env var parser inspired by mongoose schema
The npm package envoose receives a total of 0 weekly downloads. As such, envoose popularity was classified as not popular.
We found that envoose demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.