</>PackageGraphPackageGraph

cosmiconfig

npmv10.0.1TypeScript

Find and load configuration from a package.json property, rc file, TypeScript module, and more!

Safe to adopt

Yes — cosmiconfig scores well across adoption, maintenance, weight, supply chain, and licensing. 115.3M downloads per week and 3 known dependents. Last published 10 days ago. 5 releases in the last 2 years.

  • AAdoption: grade A, Excellent.

    115.3M downloads per week and 3 known dependents.

  • AMaintenance: grade A, Excellent.

    Last published 10 days ago. 5 releases in the last 2 years.

  • AWeight: grade A, Excellent.

    Pulls in 3 transitive packages, about 92 KB installed (at least — some of the tree is still being crawled).

  • ASupply chain: grade A, Excellent.

    No install scripts, 2 maintainers, and a contained dependency surface.

  • ALicense: grade A, Excellent.

    MIT — permissive, with no copyleft found in the dependency tree.

Grades are computed deterministically from registry metadata collected by PackageGraph — downloads, dependents, publish dates, the resolved dependency tree, maintainer count, and declared licenses. No third-party scores are used.

Install cost

What you actually take on by adding cosmiconfig to a project.

2
Direct dependencies

Runtime packages this one declares itself.

3
Total installed

Distinct packages in the full runtime tree, deduplicated the way a package manager would.

92 KB
Install size

Unpacked size of this package plus its entire runtime tree.

2
Tree depth

Longest resolved dependency chain below this package.

Part of this dependency tree has not been crawled yet, so these figures are a lower bound rather than a final total.

Licenses in the dependency tree

MIT

Every license you inherit by installing cosmiconfig, not just its own. Check this before a legal review, not after.

Compatibility

Node.js
node ^22.18 || >= 24
Module format
CommonJS only
TypeScript
Types included
Install scripts
None

Quick start

A usage example from the cosmiconfig README.

jsFull README ↗
const { cosmiconfig, cosmiconfigSync } = require('cosmiconfig');
// ...
const explorer = cosmiconfig(moduleName);

// Search for a configuration by walking up directories.
// See documentation for search, below.
explorer.search()
  .then((result) => {
    // result.config is the parsed configuration object.
    // result.filepath is the path to the config file that was found.
    // result.isEmpty is true if there was nothing to parse in the config file.
  })
  .catch((error) => {
    // Do something constructive.
Example truncated — see the full README.

cosmiconfig vs the alternatives

Packages solving a similar problem in the npm ecosystem, compared on the signals that drive an adoption decision.

PackageWeekly downloadsDependentsLicenseLast release
cosmiconfigthis page115.3M3MIT10 days ago
getenv07MIT1 day ago
strip-json-comments02MIT1 day ago
loose-envify65M2MIT1 day ago
@react-native/metro-config4.4M6MIT1 day ago
defaults01MIT1 day ago

Dependencies

Declared by cosmiconfig v10.0.1. Runtime dependencies are installed with the package; dev dependencies are not.

Runtime (2)

env-paths ^2.2.1js-yaml ^5.4.1

Dev (19)

@types/js-yaml ^4.0.5@types/node ^14@typescript-eslint/eslint-plugin ^6.5.0@typescript-eslint/parser ^6.5.0@vitest/coverage-istanbul ^0.34.3cross-env ^7.0.3eslint ^8.48.0eslint-config-davidtheclark-node ^0.2.2eslint-config-prettier ^9.0.0eslint-import-resolver-typescript ^3.6.0eslint-plugin-import ^2.28.1eslint-plugin-node ^11.1.0eslint-plugin-vitest ^0.2.8husky ^8.0.3lint-staged ^14.0.1parent-module ^3.0.0prettier ^3.0.3typescript ^5.2.2vitest ^0.34.3

Used by

Popular packages that depend on cosmiconfig.

lessnpm

Leaner CSS

↓ 0/wk◈ 2 dependents⚖ Apache-2.0
@react-native-community/cli-confignpm

This package is part of the [React Native CLI](../../README.md). It contains commands for managing the configuration of React Native app.

↓ 0/wk◈ 2 dependents⚖ MITTS
@oxlint-config-inspector/corenpm

Core config loading and inspection utilities for Oxlint Config Inspector.

↓ 0/wk◈ 1 dependents⚖ MIT

Relationship graph

Dependencies (left) and dependents (right) of cosmiconfig.

env-pathsless@react-native-com…@oxlint-config-in…cosmiconfig
cosmiconfig dependencies dependents

Frequently installed together

@types/nodenpm

TypeScript definitions for node

↓ 0/wk◈ 327 dependents⚖ MITTS
eslintnpm

An AST-based pattern checker for JavaScript.

↓ 138.4M/wk◈ 279 dependents⚖ MITTS
mimenpm

A comprehensive library for mime-type mapping

↓ 136.4M/wk◈ 6 dependents⚖ MITTS
webpacknpm

Packs ECMAScript/CommonJs/AMD modules for the browser. Allows you to split your codebase into multiple bundles, which can be loaded on demand. Supports loaders to preprocess files, i.e. json, jsx, es7, css, less, ... and your custom stuff.

↓ 49.8M/wk◈ 29 dependents⚖ MITTS
source-mapnpm

Generates and consumes source maps

↓ 0/wk◈ 16 dependents⚖ BSD-3-ClauseTS
copy-anythingnpm

An optimised way to copy'ing an object. A small and simple integration

↓ 0/wk◈ 1 dependents⚖ MIT
parse-node-versionnpm

Turn node's process.version into something useful.

↓ 0/wk◈ 1 dependents⚖ MIT
chainpm

BDD/TDD assertion library for node.js and the browser. Test framework agnostic.

↓ 0/wk◈ 57 dependents⚖ MIT
graceful-fsnpm

A drop-in replacement for fs, making various improvements.

↓ 0/wk◈ 24 dependents⚖ ISC
globnpm

the most correct and second fastest glob implementation in JavaScript

↓ 0/wk◈ 35 dependents⚖ BlueOak-1.0.0TS
playwrightnpm

A high-level API to automate web browsers

↓ 0/wk◈ 18 dependents⚖ Apache-2.0TS
jest-diffnpm

Display differences clearly so people can review changes confidently.

↓ 0/wk◈ 7 dependents⚖ MITTS

Release history

5 releases in the last two years, typically about 5 days apart.

Recent versions of cosmiconfig
VersionPublishedSizeLicense
10.0.1latest10 days ago77 KBMIT
10.0.01 month ago77 KBMIT
10.0.0-alpha.03 months ago71 KBMIT
9.0.23 months ago75 KBMIT
9.0.16 months ago80 KBMIT
9.0.02 years ago121 KBMIT
9.0.0-alpha.32 years ago106 KBMIT
9.0.0-alpha.22 years ago104 KBMIT
9.0.0-alpha.12 years ago117 KBMIT
9.0.0-alpha.02 years ago117 KBMIT
8.3.63 years ago77 KBMIT
8.3.53 years ago76 KBMIT
8.3.43 years ago76 KBMIT
8.3.33 years ago76 KBMIT
8.3.23 years ago76 KBMIT

Overview

cosmiconfig is an npm package that find and load configuration from a package.json property, rc file, TypeScript module, and more!. It is extremely widely used, with about 115.3M downloads per week and 3 known dependents in the graph. The latest version is 10.0.1, released under the MIT license.

Who should use it

Teams working in the npm ecosystem who need find and load configuration from a package.json property, rc file, TypeScript module, and more! and value a battle-tested, widely-adopted solution.

When not to use it

Consider an alternative if you need to minimize your dependency tree, or if a more actively-maintained option better fits your npm stack.

Pros

  • Large, well-established user base (115.3M weekly downloads).
  • Ships TypeScript type definitions.
  • Clear open-source license (MIT).

Cons

  • Large dependency tree (21 direct dependencies) increases install size and audit surface.

Auto-generated from collected registry metadata. No external claims are inferred.

Maintainers

d-fischerdavidtheclark

Keywords

configconfigurationload

Funding

Frequently asked questions

Should I use cosmiconfig?

Yes — cosmiconfig scores well across adoption, maintenance, weight, supply chain, and licensing. 115.3M downloads per week and 3 known dependents. Last published 10 days ago. 5 releases in the last 2 years.

How do I install cosmiconfig?

Run `npm install cosmiconfig` to add cosmiconfig to your npm project.

How many dependencies does cosmiconfig have?

cosmiconfig declares 21 direct dependencies and pulls in 3 packages in total once its runtime tree is resolved totalling about 92 KB on disk.

What license is cosmiconfig released under?

cosmiconfig is distributed under the MIT license.

How popular is cosmiconfig?

cosmiconfig has approximately 115,311,385 downloads per week and 3 known dependent packages.

Is cosmiconfig still maintained?

The most recent release of cosmiconfig (v10.0.1) was published 10 days ago.

Does cosmiconfig run install scripts?

No. cosmiconfig does not define preinstall, install, or postinstall scripts, so installing it does not execute publisher-supplied code.