
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
The rc npm package is a configuration loader for Node.js applications. It allows you to configure your applications with files, environment variables, and command-line arguments. This package is particularly useful for creating flexible applications that can be easily configured without changing the codebase.
Loading configuration from a file
This feature allows you to load configuration for your application named 'appname' from a file. If the file does not exist, it falls back to the default configuration provided.
const config = require('rc')('appname', { defaultConfig: 'defaultValue' });
Overriding configuration with environment variables
This demonstrates how to override a specific configuration option ('configOption') for 'appname' using an environment variable. The environment variable takes precedence over the default value.
process.env.appname_configOption = 'newValue';
const config = require('rc')('appname', { configOption: 'defaultValue' });
Using command-line arguments to override configuration
This example shows how command-line arguments can be used to override the configuration in 'appname'. The command-line argument '--configOption newValue' overrides the default configuration.
// Run the application with: node app.js --configOption newValue
const config = require('rc')('appname', { configOption: 'defaultValue' });
Similar to rc, the 'config' package is used for managing configuration settings for Node.js applications. It supports loading configurations from files and environment variables. Compared to rc, 'config' provides a more structured approach to defining default configurations and environment-specific overrides.
The 'dotenv' package is focused on loading environment variables from a .env file into process.env, providing a simple way to manage configuration settings. Unlike rc, dotenv does not support loading configurations from command-line arguments or merging configurations from multiple sources.
nconf is a hierarchical configuration management library for Node.js. It supports loading configuration from files, environment variables, command-line arguments, and even remote storage. nconf offers a more complex API compared to rc but provides greater flexibility in managing configurations from multiple sources.
The non-configurable configuration loader for lazy people.
The only option is to pass rc the name of your app, and your default configuration.
var conf = require('rc')(appname, {
//defaults go here.
port: 2468,
//defaults which are objects will be merged, not replaced
views: {
engine: 'jade'
}
});
rc
will return your configuration options merged with the defaults you specify.
If you pass in a predefined defaults object, it will be mutated:
var conf = {};
require('rc')(appname, conf);
Given your application name (appname
), rc will look in all the obvious places for configuration.
${appname}_
--config file
then from that file.${appname}rc
or the first found looking in ./ ../ ../../ ../../../
etc.$HOME/.${appname}rc
$HOME/.${appname}/config
$HOME/.config/${appname}
$HOME/.config/${appname}/config
/etc/${appname}rc
/etc/${appname}/config
All configuration sources that were found will be flattened into one object, so that sources earlier in this list override later ones.
Configuration files (e.g. .appnamerc
) may be in either json or ini format. rc ignores file extensions of configuration files. The example configurations below are equivalent:
ini
; You can include comments in `ini` format if you want.
dependsOn=0.10.0
; `rc` has built-in support for ini sections, see?
[commands]
www = ./commands/www
console = ./commands/repl
; You can even do nested sections
[generators.options]
engine = ejs
[generators.modules]
new = generate-new
engine = generate-backend
json
{
"dependsOn": "0.10.0",
"commands": {
"www": "./commands/www",
"console": "./commands/repl"
},
"generators": {
"options": {
"engine": "ejs"
},
"modules": {
"new": "generate-new",
"backend": "generate-backend"
}
}
}
Since ini, and env variables do not have a standard for types, your application needs be prepared for strings.
argv
You may pass in your own argv
as the third argument to rc
. This is in case you want to use your own command-line opts parser.
require('rc')(appname, defaults, customArgvParser);
rc
is running fs.statSync
-- so make sure you don't use it in a hot code path (e.g. a request handler)
BSD / MIT / Apache2
FAQs
hardwired configuration loader
The npm package rc receives a total of 13,996,641 weekly downloads. As such, rc popularity was classified as popular.
We found that rc demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.