@libit/conf MIT 18 versions

@libit/conf

npm

A Hierarchical node.js configuration library with files, environment variables, command-line arguments, and atomic object merging.

18

Versions

MIT

License

No

Install Scripts

Missing

Provenance

Supply chain provenance

Status for the latest visible version.

No SLSA provenance npm registry signatures gitHead linked

Without SLSA provenance there is no cryptographic link between this tarball and the public source — the axios compromise (March 2026) relied on exactly this gap.

Maintainers

towyuan

Accepted risks

Findings the reviewer chose to accept rather than block on.

Source	Rule	Reason	Accepted by	When
dependencies	unvetted-dep:ini	AI (dependencies): ini is a well-known optional dependency used as a config file format parser — appropriate and expected for a hierarchical config library.	ai	2026/04/23
dependencies	unvetted-dep:@iarna/toml	AI (dependencies): @iarna/toml is a well-known optional dependency used as a TOML format parser — appropriate and expected for a hierarchical config library.	ai	2026/04/23
phantom-deps	phantom-dep:ts-essentials	AI (phantom-deps): ts-essentials is a TypeScript utility library declared as a dependency; phantom detection reflects indirect usage, not a security concern.	ai	2026/04/23
phantom-deps	phantom-dep:ora	AI (phantom-deps): ora is a declared dependency used in config/build tooling context; phantom detection is a packaging concern, not a security issue for this library.	ai	2026/04/23
semgrep	semgrep:hex-decode	AI (semgrep): Hex decoding is used for standard AES decryption (IV and ciphertext) in a config encryption feature — expected and legitimate for a secure config library.	ai	2026/04/23
typosquat	typosquat.levenshtein:cors	AI (typosquat): @libit/conf is a scoped configuration library with no relation to the 'cors' package; the Levenshtein match is a false positive that will never be relevant for this package.	ai	2026/04/21
semgrep	semgrep:env-bulk-read	AI (semgrep): Reading all process.env keys is the core feature of an environment-variable config store; not exfiltration.	ai	2026/04/21
semgrep	semgrep:dynamic-require	AI (semgrep): Dynamic require is used to probe for optional format-parser dependencies (ini, toml, yaml, json5) with try/catch MODULE_NOT_FOUND handling — standard pattern for config libraries with optional peer deps.	ai	2026/04/21

Versions (showing 18 of 18)

Version	Deps	Published
0.5.2	11 / 23	2021-06-23
0.5.1	11 / 23	2021-06-22
0.5.0	11 / 23	2021-06-20
0.4.10	11 / 23	2021-06-20
0.4.9	11 / 23	2021-06-19
0.4.8	10 / 23	2021-06-19
0.4.7	10 / 23	2021-06-19
0.4.6	10 / 23	2021-06-19
0.4.5	10 / 23	2021-06-19
0.4.4	8 / 23	2021-06-19
0.4.3	8 / 23	2021-06-18
0.4.2	8 / 23	2021-06-18
0.4.1	8 / 23	2021-06-18
0.4.0	8 / 23	2021-06-18
0.3.3	8 / 23	2021-06-17
0.3.2	8 / 23	2021-06-17
0.3.1	7 / 23	2021-06-17
0.3.0	7 / 23	2021-06-17

v0.5.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.5.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Consider requesting the maintainer enable provenance via CI/CD.

v0.4.10

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.9

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.8

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.7

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.6

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.5

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.4

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.4.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.3

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.2

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.1

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.

v0.3.0

1 finding

LOW No provenance attestation provenance

Package was published without Sigstore provenance. Only ~12% of npm packages have provenance, so this is common but not ideal.