Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
node-config-ts
Advanced tools
A simple configuration manager for typescript based projects.
IMPORTANT: Make sure you have a local tsconfig.json
file in your project.
Install package
npm i node-config-ts
Add a postinstall
step in package.json
{
"scripts": {
"postinstall": "node-config-ts"
}
}
Create a config
directory inside your project's root folder and add a default.json
file. A typical folder structure looks as follows —
root/
└── config/
└── default.json
default.json
should contain your application's configuration
Create typings
npm install
A new Config.d.ts
will be generated automatically. This file could be ignored from git as it gets automatically generated based on the structure of default.json
Import and use node-config-ts
import {config} from 'node-config-ts'
console.log(config) // logs the config data from default.json
If your project uses webpack then with the NodeConfigTSPlugin
you can easily make your application run in the browser without any change.
webpack.config.ts
import {NodeConfigTSPlugin} from 'node-config-ts/webpack'
export = NodeConfigTSPlugin({
// .. other stuff
entry: './src/index.js',
output: {
path: path.resolve(__dirname, 'dist'),
filename: 'bundle.js'
}
})
The configs are merged in the following order of priority —
Configurations are loaded via config files that are written in JSON format for now. A typical project looks like this —
root/
└── config/
├── Config.d.ts
├── default.json
├── deployment/
│ ├── staging.example.com.json
│ ├── production.example.com.json
│ └── qa.example.com.json
├── env/
│ └── production.json
└── user/
├── ec2-user.json
├── andy.json
└── sara.json
There are three directories in which a project can have configurations — deployment
, env
and user
. These directories can have multiple files inside them and based on the environment variables an appropriate config file is selected for overriding the base default.json
. For example if the NODE_ENV
variable is set to production
the env/production.json
configuration will be merged with default.json
and override default values with its own. Similarly if DEPLOYMENT
env variable is set to staging.example.com
then deployment/staging.example.com.json
is merged with the other configs. Here is a table for environment to directory mapping —
process.env | directory |
---|---|
NODE_ENV or NODE_CONFIG_TS_ENV | /config/env |
DEPLOYMENT | /config/deployment |
USER (USERNAME) | /config/user |
User specific configuration is loaded based on USER
env variable (UNIX way)
or USERNAME
env variable (Windows way).
You can use NODE_CONFIG_TS_ENV as an alternative to NODE_ENV.
Whenever the value is prefixed with the letters @@
node-config-ts automatically looks for an environment variable with that name. For example —
// default.json
{
"port": "@@APP_PORT"
}
In the above case automatically the value of port
is set to the value that's available inside the environment variable PORT
.
export APP_PORT=3000
node server.js // server started with config.port as 3000
By default the base directory for loading configs is config
. This can be configured using the ENV variable NODE_CONFIG_TS_DIR
.
Config
typeSometimes it's necessary to access the config type info. This can be done via importing Config
.
import {config, Config} from 'node-config-ts'
const main = (c: Config) => {
/// ...
}
main(config)
The command line arguments can override all the configuration params. This is useful when you want to start a node server by passing the port externally —
node server.js --port 3000
In the above case even if the default.json
has a port setting of 9000
the cli argument can override it
// default.json
{
"port": 9000
}
node-config-ts
doesn't have it.config.get('xxx')
in node-config
you can simply use the exported config
object.get
and the has
methods to issue errors. This is unsafe typically when the configurations are different between your dev and production environments.
With node-config-ts
you can trust the typescript compiler to issue an error immediately when you try to access a property that isn't defined anywhere. Consider the following case —{
"port": 3000
}
{
"baseURL": "/api"
}
In the above case the final configuration should look something like this on john
's local machine —
{
"port": 3000,
"baseURL": "/api"
}
import config from 'config'
console.log(config.get('port'))
console.log(config.get('baseURL')) // works locally but fails in production
This would work when john
is running the application on his local machine. But as soon as its deployed in production the configuration property baseURL
isn't available anymore and it results in runtime exceptions.
import {config} from 'node-config-ts'
console.log(config.port) // proper intellisense support
console.log(config.baseURL) // throws compile time error immediately in production
Because the above object config
, is exposed with proper typings, using invalid configurations results in typescript errors. This would happen on both — john
's computer and the production server.
FAQs
A simple configuration manager for typescript based projects
The npm package node-config-ts receives a total of 8,651 weekly downloads. As such, node-config-ts popularity was classified as popular.
We found that node-config-ts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.