← Home

@prairielearn/config

npm Repository

Utilities to help load configuration from various sources including a JSON file, AWS Secrets Manager, and AWS KMS encrypted values. Config is made type-safe through a [Zod](https://github.com/colinhacks/zod) schema.

16
Versions
—
License
No
Install Scripts
Verified
Provenance

Supply chain provenance

Status for the latest visible version.

SLSA provenance attestation npm registry signatures No source commit

Maintainers

nwalters512mwest1066

Accepted risks

Findings the reviewer chose to accept rather than block on.

SourceRuleReasonAccepted byWhen
provenance missing-githead AI (provenance): CI-published monorepo package; benign gitHead gap, not a takeover signal. ai
maintainer-change maintainer-removed AI (maintainer-change): Org-managed monorepo package; maintainer list churn expected, no new suspicious maintainer added. ai
npm-metadata no-description AI (npm-metadata): Internal monorepo package lacking description is normal, not spam indicator. ai
semgrep semgrep:base64-decode AI (semgrep): Base64 decoding is used to prepare KMS ciphertext blobs for decryption — standard AWS SDK pattern, not obfuscation. ai

Versions (showing 16 of 16)

Version Deps Published
5.0.1 7 / 7
5.0.0 7 / 7
4.2.3 7 / 7
4.2.2 7 / 7
4.2.1 7 / 8
4.2.0 7 / 9
4.1.1 6 / 9
4.1.0 6 / 9
4.0.3 6 / 9
4.0.2 6 / 9
4.0.1 6 / 9
4.0.0 6 / 10
3.2.1 6 / 10
3.2.0 6 / 9
3.1.13 6 / 9
3.1.11 6 / 9

v5.0.1

2 findings
HIGH Missing gitHead — previous versions had it provenance

This version has no gitHead field linking it to a source commit, but previous versions did. This suggests the publish environment changed. Published by: GitHub Actions.

INFO Has SLSA provenance attestation provenance

Published via CI/CD with Sigstore attestation (predicate: https://slsa.dev/provenance/v1). This is the strongest supply chain integrity signal.