
Research
Namastex.ai npm Packages Hit with TeamPCP-Style CanisterWorm Malware
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.
parse local configuration files of various types. currently supported filetypes: json,yaml,yml,js (must module.exports = {};)
lconf supports three methods:
parse(file:string, [regex:RegExp]):
parses a configuration file located at file. note: if file is relative, it will be resolved from process.cwd(). if file is a directory, all
files inside the directory will be included. if regex is given, file (if actual file) or all files in directory (if file is a directory) will
be compared against regex, and added if regex.test(filePath) returns true.
suppress(bool:boolean[default=true]):
toggles throwing of exceptions when parsing. using suppress() will prevent throwing of errors.
opts():
does the actual parse, and throws errors if there are any, and we aren't suppress()-ed.
these methods can be chained together:
var lconf = require('lconf');
// parse multiple configuration files
var config = lconf().parse('./config.yaml').parse('./config.json').opts();
the resulting object will look like:
{
"./config.yaml": {...},
"./config.json": {...}
}
If you want to smash configuration variables into one object, see bengreenier/hulksmash.
parse some config files that may or may not be present:
var lconf = require('lconf');
// parse multiple configuration files
var config = lconf()
.parse('./idk.yaml')
.parse('./if.json')
.parse('./these.json')
.parse('./are.json')
.parse('./present.js')
.suppress()
.opts();
// could check config object keys to see what succeeded
reuse parsing instance:
var lconf = require('lconf');
// parse multiple configuration files
var parser = lconf();
var config = parser
.parse('./config.yaml')
.parse('./config.json')
.opts();
var settings = parser
.parse('./settings.yaml')
.parse('./settings.json')
.opts();
// config will have two keys (one for each .parse() filename)
// settings will have two as well.
// each call to .opts() clears previously parsed data
FAQs
parse local configuration files of various types
The npm package lconf receives a total of 2 weekly downloads. As such, lconf popularity was classified as not popular.
We found that lconf demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Malicious Namastex.ai npm packages appear to replicate TeamPCP-style Canister Worm tradecraft, including exfiltration and self-propagation.

Product
Explore exportable charts for vulnerabilities, dependencies, and usage with Reports, Socket’s new extensible reporting framework.

Product
Socket for Jira lets teams turn alerts into Jira tickets with manual creation, automated ticketing rules, and two-way sync.