@haibun/core - npm Package Compare versions

Comparing version 1.0.0 to 1.0.1

build/lib/namedVars.js

@@ -8,2 +8,3 @@ "use strict";
 const TYPE_CREDENTIAL = 'c_';
+const TYPE_ENV = 'e_';
 const TYPE_VAR = 'b_';
@@ -16,4 +17,5 @@ // from source or literal
     const b = `\`(?<${TYPE_VAR}${num}>.+)\``; // var
+    const e = `\{(?<${TYPE_ENV}${num}>.+)\}`; // var
     const t = `(?<${TYPE_VAR_OR_LITERAL}${num}>.+)`; // var or literal
-    return `(${q}|${c}|${b}|${t})`;
+    return `(${q}|${c}|${e}|${b}|${t})`;
 };
@@ -97,2 +99,10 @@ exports.matchGroups = matchGroups;
         }
+        else if (namedKey.startsWith(TYPE_ENV)) {
+            // FIXME add test
+            const val = process.env[namedValue];
+            if (!val) {
+                throw Error(`no env value for "${namedValue}" from ${JSON.stringify({ shared, type })}`);
+            }
+            namedFromVars[name] = val;
+        }
         else if (namedKey.startsWith(TYPE_QUOTED)) {
@@ -99,0 +109,0 @@ // quoted

package.json

 {
   "name": "@haibun/core",
-  "version": "1.0.0",
+  "version": "1.0.1",
   "description": "",
@@ -5,0 +5,0 @@ "author": "",

New alerts

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

218085

increased by0.37%

Lines of code

2807

increased by0.36%

Worsened metrics

Number of low supply chain risk alerts

7

increased by16.67%

No dependency changes