
Research
/Security News
10 npm Typosquatted Packages Deploy Multi-Stage Credential Harvester
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.
@cjkihl/turbo-env
Advanced tools
A CLI tool and library for automatically syncing environment variables from .env files to your Turborepo configuration.
.env files to turbo.json# Using npm
npm install turbo-env
# Using yarn
yarn add turbo-env
# Using pnpm
pnpm add turbo-env
The CLI tool can be used to quickly sync your environment variables:
# Use default env files (.env.local, .env)
turbo-env
# Specify custom env files
turbo-env -e .env.production .env.staging .env
You can also use the package programmatically in your Node.js code:
import setTurboEnv from 'turbo-env';
// Use default env files (.env.local, .env)
await setTurboEnv({});
// Specify custom env files
await setTurboEnv({
envFile: ['.env.production', '.env.staging', '.env']
});
setTurboEnv(config: WithEnvConfig)Synchronizes environment variables from .env files to your Turborepo configuration.
config (optional): Configuration object
envFile (optional): Array of environment file paths to check in order of priority
['.env.local', '.env']Promise<void>Error if no environment variables are found in any of the specified env filesError if turbo.json file doesn't existglobalEnv array in your turbo.json configurationturbo.jsonContributions are welcome! Please feel free to submit a Pull Request.
MIT
FAQs
Set environment variables for a turbo build from a .env file
We found that @cjkihl/turbo-env demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers found 10 typosquatted npm packages that auto-run on install, show fake CAPTCHAs, fingerprint by IP, and deploy a credential stealer.

Product
Socket Firewall Enterprise is now available with flexible deployment, configurable policies, and expanded language support.

Security News
Open source dashboard CNAPulse tracks CVE Numbering Authorities’ publishing activity, highlighting trends and transparency across the CVE ecosystem.