
Research
Security News
Lazarus Strikes npm Again with New Wave of Malicious Packages
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
@creatrip/env-safe
Advanced tools
🔑 Loads environment variables from .env for nodejs projects with safe
env-safe is module that loads environment variables from a .env
file into process.env
with type-safe. And can also validate the type of process.env
. env-safe is dependent on dotenv and reflect-metadata.
npm install @creatrip/env-safe --save
Or installing with yarn? yarn add @creatrip/env-safe
Turn on emitDecoratorMetadata
, experimentalDecorators
in tsconfig.json:
{
"compilerOptions": {
"emitDecoratorMetadata": true,
"experimentalDecorators": true
...
}
...
}
Create a .env
file in the root of your project:
DATABASE_HOST="localhost"
DATABASE_PORT=3306
Use env-safe to create env config class:
import { EnvSafe, EnvKey } from '@creatrip/env-safe';
@EnvSafe()
export class Env {
@EnvKey()
static DATABASE_HOST: string;
@EnvKey()
static DATABASE_PORT: number;
}
filename: env.ts
That's it. Just use the newly created config class:
import { Env } from './env.ts';
mysql.connect({
host: Env.DATABASE_HOST, // String("localhost")
port: Env.DATABASE_PORT, // Number(3306)
});
Comments may be added to your file on their own line or inline:
# This is a comment
DATABASE_HOST="localhost" # comment
DATABASE_PASSWORD="can-define-with-#"
Comments begin where a #
exists, so if your value contains a #
please wrap it in quotes.
Set default value to env config class property:
@EnvSafe()
export class Env {
@EnvKey({ default: 'localhost' })
static DATABASE_HOST: string;
@EnvKey({ default: 3306 })
static DATABASE_PORT: number;
}
Set nullable to env config class property:
@EnvSafe()
export class Env {
@EnvKey({ nullable: true })
static DATABASE_HOST: string | null; // String or null
}
Since the provided .env
does not contain all the variables defined in env config class, an exception is thrown:
DATABASE_HOST=
DATABASE_PORT="wrong data"
@EnvSafe()
export class Env {
@EnvKey()
static DATABASE_HOST: string; // Not defined Error
@EnvKey()
static DATABASE_PORT: number; // NaN Error
@EnvKey()
static DATABASE_USER: string; // Not defined Error
}
$ node dist/index.js
ERROR: .env - DATABASE_HOST is not defined
ERROR: .env - DATABASE_PORT is not allowed
ERROR: .env - DATABASE_USER is not defined
.env
pathCan change .env
path in your project:
$ ls
development.env stagging.env production.env
@EnvSafe({ path: 'development.env' })
export class Env {
...
}
Can define multiple env config class:
AWS_SECRET_KEY="secret key"
S3_BUCKET="bucket name"
@EnvSafe()
export class EnvAWS {
@EnvKey()
static AWS_SECRET_KEY: string; // String("secret key")
}
@EnvSafe()
export class EnvS3 {
@EnvKey()
static S3_BUCKET: string; // String("bucket name")
}
If you don't make .env, just run application. .env will automatically generated by env class:
See CONTRIBUTING.md
FAQs
🔑 Loads environment variables from .env for nodejs projects with safe
We found that @creatrip/env-safe demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
The Socket Research Team has discovered six new malicious npm packages linked to North Korea’s Lazarus Group, designed to steal credentials and deploy backdoors.
Security News
Socket CEO Feross Aboukhadijeh discusses the open web, open source security, and how Socket tackles software supply chain attacks on The Pair Program podcast.
Security News
Opengrep continues building momentum with the alpha release of its Playground tool, demonstrating the project's rapid evolution just two months after its initial launch.