
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
@notross/dotenv-config
Advanced tools
A simple client that makes environment variables available as objects.
A simple client that makes environment variables available as objects.
Features:
# NPM
npm install @notross/dotenv-config
# Yarn
yarn add @notross/dotenv-config
.env as usual# .env
MONGO_DB=test
MONGO_USERNAME=admin
MONGO_PASSWORD=secret
MONGO_HOST=localhost
MONGO_PORT=27017
ALPACA_API_KEY_ID=XXXXXXXXXXXXXXXXXXXX
ALPACA_API_SECRET_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
env(...) method// database.ts
import { env } from '@notross/dotenv-config'
const { mongo } = env() // returns each .env entry
// prefixed with "MONGO_"
const {
username, // MONGO_USERNAME
password, // MONGO_PASSWORD
host, // MONGO_HOST
port, // MONGO_PORT
} = mongo
const mongoURI = `mongodb://${username}:${password}@${host}:${port}`
Let's take our example .env file:
# .env
MONGO_DB=test
MONGO_USERNAME=admin
MONGO_PASSWORD=secret
MONGO_HOST=localhost
MONGO_PORT=27017
ALPACA_API_KEY_ID=XXXXXXXXXXXXXXXXXXXX
ALPACA_API_SECRET_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
Each variable name is separated into two parts:
The prefix will be accessible as a lowercase key of the env(...) return object:
env().alpaca
The keys will be camel-cased, accessible through the env(...) object's prefix:
const { apiKeyId, apiSecretKey } = env().alpaca
⚠️ Prefixes and camel-casing are only automatically detected if they are delineated by an underscore:
`PREFIX_VARIABLE_NAME=value` --> `prefix: { variableName: 'value' }`
You may access various sets of ENV variables via prefix from the env(...) object:
const { alpaca, mongo } = env()
You may access specific variables by passing the prefix to the env(...) method
# .env
ALPACA_API_KEY_ID=XXXXXXXXXXXXXXXXXXXX
ALPACA_API_SECRET_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX
// markets.ts
import { env } from '@notross/dotenv-config'
const { keyId, secretKey } = env('ALPACA_API')
const headers = new Headers({
'accept': 'application/json',
'APCA-API-KEY-ID', keyId,
'APCA-API-SECRET-KEY': secretKey,
})
Templating provides an easy way to dynamically construct variables using existing ENV values.
Example
# .env
MONGO_USERNAME=admin
MONGO_PASSWORD=secret
MONGO_HOST=localhost
MONGO_PORT=27017
# Combine the MONGO_ variables to form a connection string
MONGO_URI=mongodb+srv://{{username}}:{{password}}@{{host}}:{{port}}
// database.ts
import { env } from '@notross/dotenv-config'
import { MongoClient } from 'mongodb'
const { mongo: { uri } } = env()
const client = new MongoClient(uri)
MIT © @notross
FAQs
A simple client that makes environment variables available as objects.
We found that @notross/dotenv-config demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.