Research
Security News
Threat Actor Exposes Playbook for Exploiting npm to Build Blockchain-Powered Botnets
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
@adonisjs/env
Advanced tools
Environment variables parser and reader for Node.js. This module parses the raw string in dotfile format and set process.env
variables from it. Also, you can make use of bash like syntax for variable interpolation.
Install the package from npm as follows:
npm i @adonisjs/env
# yarn
yarn add @adonisjs/env
and then use it as follows
import { env } from '@adonisjs/env/build/standalone'
env.process(`
PORT=3333
HOST=127.0.0.1
`)
and then read the values as follows
env.get('PORT')
// or
process.env.PORT
The Env.process
method will not overwrite the existing environment variables (that is how it should be). However, if you want to overwrite existing values, maybe inside testing environment, then you can call the process
method as follows:
env.process('PORT=3333', true)
The @adonisjs/core
includes this module and hence there is no need to install it seperately. However, here are the instructions to setup the provider.
export const providers = [
'@adonisjs/env/build/providers/EnvProvider',
]
After this, you have to register the typings file inside files
array for Typescript to pick the ambient module.
All this hassle is required, since this module is never meant to be installed standalone.
tsconfig.json
{
"files": ["./node_modules/@adonisjs/env/build/adonis-typings/env.d.ts"]
}
The EnvProvider
will look for .env
file is the project root and parses it's content automatically. When not using this with AdonisJs, then you need to perform this process by yourself.
The values saved as environment variables are always string. However, this module does the values casting for you, when you read them using Env.get
.
env.process(`
CACHE_VIEWS=false
`)
process.env.CACHE_VIEWS // string
env.get('CACHE_VIEWS') // boolean
Following values are casted
.env Value | Casted value |
---|---|
'null' | null |
'true' | true |
'1' | true |
'false' | false |
'0' | false |
You can also reference environment variables by using bash like interpolation syntax.
env.process(`
HOST=localhost
PORT=3333
URL=$HOST:$PORT
`)
All letter
, numbers
and _
after the dollar sign will be considered as a variable reference. Any other characters apart from the above mentioned aren't allowed. However, you can wrap your variable substitution inside curly braces {}
when using characters other than the whitelisted one's.
The following reference to $REDIS-USER
will fail, since the parser will stop at -
and consider USER
as a static string.
env.process(`
REDIS-USER=foo
REDIS-URL=localhost@$REDIS-USER
`)
The usage of curly braces {}
tells the parser to parse until the closing brace.
env.process(`
REDIS-USER=foo
REDIS-URL=localhost@${REDIS-USER}
`)
Quite often, you will have strings where you want the $
dollar character to be considered as a literal value. In that case you can escape the character as follows.
env.process(`
PASSWORD=pa\\$\\$word
`)
process.env.PASSWORD // pa$$word
DO NOTE: The usage of double escape
\\
is required when you are typing the string directly in Javascript, since the first escape is swallowed by JS. However, if you are writing the enviornment variables inside the.env
file, then a single escape\
is required.
Following are the autogenerated files via Typedoc
FAQs
Environment variable manager for Node.js
The npm package @adonisjs/env receives a total of 25,894 weekly downloads. As such, @adonisjs/env popularity was classified as popular.
We found that @adonisjs/env demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 3 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A threat actor's playbook for exploiting the npm ecosystem was exposed on the dark web, detailing how to build a blockchain-powered botnet.
Security News
NVD’s backlog surpasses 20,000 CVEs as analysis slows and NIST announces new system updates to address ongoing delays.
Security News
Research
A malicious npm package disguised as a WhatsApp client is exploiting authentication flows with a remote kill switch to exfiltrate data and destroy files.