
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
mwp-config
Advanced tools
This is the 'main' config for all Meetup Web Platform applications. It is intended to consolidate both buildtime and runtime configuration properties and rules, including Babel and Webpack configuration, Node server config, and configuration needed to to interface with external services such as Travis CI and Transifex.
By consolidating all of this configuration into a single module/package, all downstream dependencies can explicitly opt-in to reading configuration values that determine the behavior of the system.
Important: browser-run scripts should never directly import configuration values. Instead, config should be read from the application state provided to the client on initial render.
The root-level modules of the config package each organize some information that
is used by many different packages. For the most part, they describe the
application environment, e.g. standard file paths
, env
values, and package
config values.
All Babel plugins and presets are defined in the /babel
module.
The /server
module defines the runtime configuration of the Node application
server. It is essentially an extension of the /env
config, but adds a few more
host and authentication configuration values.
Server config code uses node-convict for configuration management. The platform will automatically provide a base set of dev-friendly defaults for all non-secret values.
All default values can be overwritten via a local config file or environment vars. Using a config file is preferred in order to not interfere with other apps running in the same environment.
Configuration values are read in the following order of precedence:
config.<NODE_ENV>.json
fileserver/index.js
Config files should be placed in the root of the application repo, and be named
with the format config.<target NODE_ENV>.json
, e.g.
config.test.json
(can be committed - should not contain secrets)config.development.json
(must be .gitignore
d)config.production.json
(must be .gitignore
d)process.env
keys supported in client codeAlthough process.env
is typically only available in server-side code, our
bundling process can automatically inject certain environment values into the
client bundle wherever it finds a supported process.env.YOUR_ENV_VAR
expression.
Supported environment variables are declared using the
webpack.EnvironmentPlugin
in browserAppConfig
FAQs
All the config you might ever need for a MWP app
We found that mwp-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.