Security News
Node.js EOL Versions CVE Dubbed the "Worst CVE of the Year" by Security Experts
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
@dotenvx/dotenvx
Advanced tools
a better dotenv–from the creator of dotenv
.
brew install dotenvx/brew/dotenvx
$ echo "HELLO=World" > .env && echo "console.log('Hello ' + process.env.HELLO)" > index.js
$ node index.js
Hello undefined
$ dotenvx run -- node index.js
Hello World
> :-D
More examples
$ echo "HELLO=World" > .env && echo 'import os;print("Hello " + os.getenv("HELLO", ""))' > index.py
$ dotenvx run -- python3 index.py
Hello World
$ echo "HELLO=World" > .env && echo '<?php echo "Hello {$_SERVER["HELLO"]}\n";' > index.php
$ dotenvx run -- php index.php
Hello World
$ echo "HELLO=World" > .env && echo 'puts "Hello #{ENV["HELLO"]}"' > index.rb
$ dotenvx run -- ruby index.rb
Hello World
$ echo "HELLO=World" > .env && echo 'fn main() {let hello = std::env::var("HELLO").unwrap_or("".to_string());println!("Hello {hello}");}' > src/main.rs
$ dotenvx run -- cargo run
Hello World
$ echo "HELLO=World" > .env && echo 'public class Index { public static void main(String[] args) { System.out.println("Hello " + System.getenv("HELLO")); } }' > index.java
$ dotenvx run -- java index.java
Hello World
$ dotnet new console -n HelloWorld -o HelloWorld
$ cd HelloWorld
$ echo "HELLO=World" > .env && echo 'Console.WriteLine($"Hello {Environment.GetEnvironmentVariable("HELLO")}");' > Program.cs && echo "HELLO=World" > .env
$ dotenvx run -- dotnet run
Hello World
$ dotenvx run -- next dev
$ dotenvx run -- npm start
$ dotenvx run -- bin/rails s
$ dotenvx run -- php artisan serve
$ docker run -it --rm -v $(pwd):/app dotenv/dotenvx run -- node index.js
Or in any image:
FROM node:latest
RUN echo "HELLO=World" > .env && echo "console.log('Hello ' + process.env.HELLO)" > index.js
RUN curl -fsS https://dotenvx.sh/ | sh
CMD ["dotenvx", "run", "--", "echo", "Hello $HELLO"]
examples coming soon
examples coming soon
# alternatively use npx
$ npx @dotenvx/dotenvx run -- node index.js
$ npx @dotenvx/dotenvx run -- next dev
$ npx @dotenvx/dotenvx run -- npm start
$ npm install @dotenvx/dotenvx --save
{
"scripts": {
"start": "./node_modules/.bin/dotenvx run -- node index.js"
},
"dependencies": {
"@dotenvx/dotenvx": "^0.5.0"
}
}
$ npm run start
> start
> ./node_modules/.bin/dotenvx run -- node index.js
[dotenvx][INFO] injecting 1 environment variable from .env
Hello World
# use as a git submodule
$ git dotenvx run -- node index.js
$ git dotenvx run -- next dev
$ git dotenvx run -- npm start
Create a
.env.production
file and use--env-file
to load it. It's straightforward, yet flexible.
$ echo "HELLO=production" > .env.production && echo "console.log('Hello ' + process.env.HELLO)" > index.js
$ dotenvx run --env-file=.env.production -- node index.js
Hello production
> ^^
More examples
$ echo "HELLO=local" > .env.local
$ echo "HELLO=World" > .env
$ dotenvx run --env-file=.env.local --env-file=.env -- node index.js
Hello local
$ echo "HELLO=local" > .env.local
$ echo "HELLO=World" > .env
$ dotenvx run --env-file=.env.local --env-file=.env --overload -- node index.js
Hello World
$ echo "HELLO=production" > .env.production
$ dotenvx run --env-file=.env.production --verbose -- node index.js
[dotenvx][VERBOSE] injecting env from /path/to/.env.production
[dotenvx][VERBOSE] HELLO set
[dotenvx][INFO] injecting 1 environment variable from .env.production
Hello production
$ echo "HELLO=production" > .env.production
$ dotenvx run --env-file=.env.production --debug -- node index.js
[dotenvx][DEBUG] configuring options
[dotenvx][DEBUG] {"envFile":[".env.production"]}
[dotenvx][VERBOSE] injecting env from /path/to/.env.production
[dotenvx][DEBUG] reading env from /path/to/.env.production
[dotenvx][DEBUG] parsing env from /path/to/.env.production
[dotenvx][DEBUG] {"HELLO":"production"}
[dotenvx][DEBUG] writing env from /path/to/.env.production
[dotenvx][VERBOSE] HELLO set
[dotenvx][DEBUG] HELLO set to production
[dotenvx][INFO] injecting 1 environment variable from .env.production
Hello production
Encrypt your secrets to a
.env.vault
file.
$ echo "HELLO=World" > .env && echo "console.log('Hello ' + process.env.HELLO)" > index.js
$ echo "HELLO=production" > .env.production
$ dotenvx encrypt
[dotenvx][INFO] encrypted .env,.env.production to .env.vault
[dotenvx][INFO]
[dotenvx][INFO] try it out:
[dotenvx][INFO]
[dotenvx][INFO] DOTENV_KEY='<DOTENV_KEY_ENVIRONMENT>' dotenvx run -- node index.js
[dotenvx][INFO]
[dotenvx][INFO] next:
[dotenvx][INFO]
[dotenvx][INFO] 1. commit .env.vault safely to code
[dotenvx][INFO] 2. set DOTENV_KEY on server (or ci)
[dotenvx][INFO] 3. push your code
[dotenvx][INFO]
[dotenvx][INFO] tips:
[dotenvx][INFO]
[dotenvx][INFO] * .env.keys file holds your decryption DOTENV_KEYs
[dotenvx][INFO] * DO NOT commit .env.keys to code
[dotenvx][INFO] * share .env.keys file over secure channels only
> :-]
Then load env from encrypted
.env.vault
file
$ DOTENV_KEY='dotenv://:key_abc123@dotenvx.com/vault/.env.vault?environment=production' dotenvx run -- node index.js
[dotenvx][INFO] injecting 1 environment variable from encrypted .env.vault
Hello production
> :-]
More examples
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
coming soon
Begin by creating a simple 'hello world' program.
// index.js
console.log(`Hello ${process.env.HELLO}`)
Run it.
$ node index.js
Hello undefined
Run it with dotenvx
.
$ dotenvx run -- node index.js
[dotenvx][WARN] ENOENT: no such file or directory, open '/../../.env'
Hello undefined
It warns you when there is no .env
file (pass the --quiet
flag to suppress these warnings).
Create the .env
file.
# env
JELLO="World"
Run it again.
$ dotenvx run -- node index.js
[dotenvx][INFO] injecting 0 environment variables from .env
Hello undefined
Hrm, still undefined. Pass the --debug
flag to debug the issue. I'll give you a hint: 🍮
$ dotenvx run --debug -- node index.js
[dotenvx][VERBOSE] Loading env from /../../.env
[dotenvx][DEBUG] Reading env from /../../.env
[dotenvx][DEBUG] Parsing env from /../../.env
[dotenvx][DEBUG] {"JELLO":"World"}
# Oops, HELLO not JELLO ^^
Fix your .env
file.
# .env
HELLO="World"
One last time. Le tired.
$ dotenvx run -- node index.js
[dotenvx][INFO] injecting 1 environment variable from .env
Hello World
🎉 It worked!
You can fork this repo and create pull requests or if you have questions or feedback:
FAQs
a better dotenv–from the creator of `dotenv`
The npm package @dotenvx/dotenvx receives a total of 182,320 weekly downloads. As such, @dotenvx/dotenvx popularity was classified as popular.
We found that @dotenvx/dotenvx demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 2 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Critics call the Node.js EOL CVE a misuse of the system, sparking debate over CVE standards and the growing noise in vulnerability databases.
Security News
cURL and Go security teams are publicly rejecting CVSS as flawed for assessing vulnerabilities and are calling for more accurate, context-aware approaches.
Security News
Bun 1.2 enhances its JavaScript runtime with 90% Node.js compatibility, built-in S3 and Postgres support, HTML Imports, and faster, cloud-first performance.