@libit/conf
A Hierarchical node.js configuration library with files, environment variables, command-line arguments, and atomic object merging.
18
Versions
MIT
License
No
Install Scripts
Missing
Provenance
Supply chain provenance
Status for the latest visible version.
No SLSA provenance
npm registry signatures
gitHead linked
Without SLSA provenance there is no cryptographic link between this tarball and the public source, so a manually published version cannot be tied back to a reviewed commit.
Maintainers
towyuan
Accepted risks
Findings the reviewer chose to accept rather than block on.
| Source | Rule | Reason | Accepted by | When |
|---|---|---|---|---|
| dependencies | unvetted-dep:ini | AI (dependencies): ini is a well-known optional dependency used as a config file format parser — appropriate and expected for a hierarchical config library. | ai | |
| dependencies | unvetted-dep:@iarna/toml | AI (dependencies): @iarna/toml is a well-known optional dependency used as a TOML format parser — appropriate and expected for a hierarchical config library. | ai | |
| phantom-deps | phantom-dep:ts-essentials | AI (phantom-deps): ts-essentials is a TypeScript utility library declared as a dependency; phantom detection reflects indirect usage, not a security concern. | ai | |
| phantom-deps | phantom-dep:ora | AI (phantom-deps): ora is a declared dependency used in config/build tooling context; phantom detection is a packaging concern, not a security issue for this library. | ai | |
| semgrep | semgrep:hex-decode | AI (semgrep): Hex decoding is used for standard AES decryption (IV and ciphertext) in a config encryption feature — expected and legitimate for a secure config library. | ai | |
| typosquat | typosquat.levenshtein:cors | AI (typosquat): @libit/conf is a scoped configuration library with no relation to the 'cors' package; the Levenshtein match is a false positive that will never be relevant for this package. | ai | |
| semgrep | semgrep:env-bulk-read | AI (semgrep): Reading all process.env keys is the core feature of an environment-variable config store; not exfiltration. | ai | |
| semgrep | semgrep:dynamic-require | AI (semgrep): Dynamic require is used to probe for optional format-parser dependencies (ini, toml, yaml, json5) with try/catch MODULE_NOT_FOUND handling — standard pattern for config libraries with optional peer deps. | ai |