
Security News
TeamPCP and BreachForums Launch $1,000 Contest for Supply Chain Attacks
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.
@rpcbase/babel-plugin-dotenv-import
Advanced tools
Load environment variables using import statements.
Load environment variables using
importstatements.
$ npm install babel-plugin-dotenv-import
.babelrc
{
"plugins": [
["dotenv-import", {
"moduleName": "@env",
"path": ".env",
"blocklist": null,
"allowlist": null,
"safe": false,
"allowUndefined": false
}]
]
}
.env
API_URL=https://api.example.org
API_TOKEN=
In users.js
import {API_URL, API_TOKEN} from "@env"
fetch(`${API_URL}/users`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`
}
})
It is possible to limit the scope of env variables that will be imported by specifying a allowlist and/or a blocklist as an array of strings.
{
"plugins": [
["dotenv-import", {
"blocklist": [
"GITHUB_TOKEN"
]
}]
]
}
{
"plugins": [
["dotenv-import", {
"allowlist": [
"API_URL",
"API_TOKEN"
]
}]
]
}
Enable safe mode to only allow environment variables defined in the .env file. This will completely ignore everything that is already defined in the environment.
The .env file has to exist.
{
"plugins": [
["dotenv-import", {
"safe": true
}]
]
}
Allow importing undefined variables, their value will be undefined.
{
"plugins": [
["dotenv-import", {
"allowUndefined": true
}]
]
}
import {UNDEFINED_VAR} from '@env'
console.log(UNDEFINED_VAR === undefined) // true
When false (default behavior), an error will be thrown.
Alternatively, allowUndefined can be an array specifying the names of variables that are allowed to be undefined. Only the listed variables will be imported without errors if they are not defined, while others will still cause an error.
{
"plugins": [
["dotenv-import", {
"allowUndefined": ["ALLOWED_UNDEFINED_VAR"]
}]
]
}
import {ALLOWED_UNDEFINED_VAR, UNALLOWED_UNDEFINED} from '@env'
console.log(ALLOWED_UNDEFINED_VAR === undefined) // true
console.log(UNALLOWED_UNDEFINED) // Throws an error if not defined in .env
When using with babel-loader with caching enabled you will run into issues where environment changes won’t be picked up.
This is due to the fact that babel-loader computes a cacheIdentifier that does not take your environment into account.
You can easily clear the cache:
rm -rf node_modules/.cache/babel-loader/*
Or you can override the default cacheIdentifier to include some of your environment variables.
Based on David Chang’s works on babel-plugin-dotenv.
╚⊙ ⊙╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
FAQs
Load environment variables using import statements.
We found that @rpcbase/babel-plugin-dotenv-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.

Research
GemStuffer abuses RubyGems as an exfiltration channel, packaging scraped UK council portal data into junk gems published from new accounts.