
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
@bb-tools/withenv
Advanced tools
This projects aims to simplify loading of environment variables with dotenv in a monorepo.
It consists of 2 parts:
withenv command which we use to call dotenv before running commands.loadEnv function which you can reuse in any TS/JS code.See the Configuration section for details about the .env.yaml file or continue reading for usage instructions.
npm install @bb-tools/withenv
Usage:
withenv <env> -- [command...]
Example:
withenv test -- jest
Usage:
import { loadEnv } from "withenv";
// Loads the environment into process.env
await loadEnv("test");
Most of the magic behind withenv is a .env.yaml file whose goal is to define execution environments in a declarative way.
Example:
dev:
nodeEnv: development
files:
- .env.dev
In this file, an environment named dev is declared.
As you might have guessed, when used with the dev environment, withenv will:
Set the NODE_ENV environment variable value to development.
Load non-sensitive environment variables from the .env.dev dotenv file located alongside the .env.yaml file.
Load local overrides and secrets from the .env.dev.local dotenv file.
The properties described in the table below can be used for each environment defined in the .env.yaml file.
| Name | Description | Required | Default value |
|---|---|---|---|
nodeEnv | The value of NODE_ENV to use | NO | Environment name if it exists in the NodeEnv enum of @kwentapay/node-utils package. |
files | List of .env files to be loaded. | YES | |
alias | An optional alias to name the environment (e.g. development instead of dev) | NO |
Local files can be defined for both the dotenv and withenv:
<environment_file>.local (e.g. .env.local) to define local environment variables.
.env.local.yaml to add new environments or override the existing ones.
i.e.: This is where your personal secrets can be placed.
These files must be ignored by Git (documentation). For example, you can add the following lines to your .gitignore file:
*.local
*.local.yaml
See:
The src/load-env.ts file for details about the loading process.
The src/config.ts file to see the configuration TS types.
FAQs
An environment variable loader for your monorepo.
The npm package @bb-tools/withenv receives a total of 2 weekly downloads. As such, @bb-tools/withenv popularity was classified as not popular.
We found that @bb-tools/withenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.