
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
NodeJS config loader. Reads a config.js, package.json, LICENSE, .env and CHANGELOG.md.
npm install rf-config
To load this config.js file in ./config/config.js:
module.exports = {
// we can have any content here
config: 'local',
abc: 'def',
// "paths" is predefined to store all projects paths
paths: {
myReadme: 'README.md', // /README.md in root folder
gitignore: '.gitignore',
webserver: 'dest',
server: 'server',
}
};
Use this single line:
var config = require('rf-config').init(__dirname); // root path '__dirname'
console.log(config);
// this returns a configuration like:
{
config: 'local', // variables
abc: 'def',
paths: { // the paths in absolute form for easy backend use
myReadme: '/home/user/project/README.md',
gitignore: '/home/user/project/.gitignore',
webserver: '/home/user/project/dest',
server: '/home/user/project/server',
},
pathsRelative: { // the paths also relative
myReadme: 'README.md',
gitignore: '.gitignore',
webserver: 'dest',
server: 'server',
},
app: { // other infos we got for the app
name: 'rf-config',
version: '0.1.6',
packageJson: {
name: 'rf-config',
version: '0.1.6',
description: 'Simple NodeJS config loading lib',
author: 'Rapidfacture GmbH',
license: 'MIT',
main: 'index.js'
}
}
}
Once Loaded, access the configuration later in other files with:
var config = require('rf-config');
NOTE: The init function is only present the first time, as the config should be loaded only once - when the project starts.
Install the dev tools with
npm install
Then you can runs some test cases and eslint with:
npm test
FAQs
NodeJS config loader. Reads a config.js, package.json, LICENSE and .env
The npm package rf-config receives a total of 67 weekly downloads. As such, rf-config popularity was classified as not popular.
We found that rf-config demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 7 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.