
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
@scaffit/env
Advanced tools
Environment variable setup with Zod validation for Next.js, React, Vue, Angular, Svelte, Express, Fastify, Node.js projects
Environment variable setup with Zod validation.
# Add environment scaffold (no installation needed!)
npx scaffit add env
# Install CLI globally
npm install -g scaffit
# Add environment scaffold
scaffit add env
# Install scaffold directly
npm install @scaffit/env
# Use in your code
import { setupEnv, previewEnv } from '@scaffit/env';
// Setup environment variables with custom options
const result = await setupEnv({
includeExamples: true,
useZod: true,
features: ['database', 'auth', 'apis'],
projectRoot: './my-project'
});
// Preview changes before applying
const preview = await previewEnv({
useZod: true,
features: ['database', 'auth']
});
Note: Both approaches require @scaffit/core to be installed (automatically handled).
After installation, you can immediately use environment variables:
# Copy the example file and fill in your values
cp .env.example .env.local
# Your environment variables are now validated and type-safe
Note: Environment setup is ready to use immediately after installation.
Template file with example environment variables (framework-specific):
Next.js:
# Next.js Configuration
NEXTAUTH_URL="http://localhost:3000"
NEXTAUTH_SECRET="your-secret-key-here"
# Database
DATABASE_URL="postgresql://username:password@localhost:5432/database"
# API Keys
OPENAI_API_KEY="your-openai-key-here"
STRIPE_SECRET_KEY="your-stripe-secret-key"
React/Vue/Svelte:
# React/Vue/Svelte Configuration
VITE_API_URL="http://localhost:3000"
# Database
DATABASE_URL="postgresql://username:password@localhost:5432/database"
# API Keys
OPENAI_API_KEY="your-openai-key-here"
STRIPE_SECRET_KEY="your-stripe-secret-key"
Express/Fastify/Node.js:
# Express/Fastify Configuration
PORT=3000
NODE_ENV="development"
# Database
DATABASE_URL="postgresql://username:password@localhost:5432/database"
# Authentication
JWT_SECRET="your-jwt-secret-here"
SESSION_SECRET="your-session-secret-here"
Type-safe environment validation (framework-specific):
Next.js:
import { z } from 'zod';
const envSchema = z.object({
NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
NEXTAUTH_URL: z.string().url(),
NEXTAUTH_SECRET: z.string().min(32),
DATABASE_URL: z.string().url(),
OPENAI_API_KEY: z.string().optional(),
STRIPE_SECRET_KEY: z.string().optional(),
});
export const env = envSchema.parse(process.env);
export type Env = z.infer<typeof envSchema>;
React/Vue/Svelte:
import { z } from 'zod';
const envSchema = z.object({
NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
VITE_API_URL: z.string().url(),
DATABASE_URL: z.string().url(),
OPENAI_API_KEY: z.string().optional(),
STRIPE_SECRET_KEY: z.string().optional(),
});
export const env = envSchema.parse(process.env);
export type Env = z.infer<typeof envSchema>;
Express/Fastify/Node.js:
import { z } from 'zod';
const envSchema = z.object({
NODE_ENV: z.enum(['development', 'production', 'test']).default('development'),
PORT: z.string().default('3000'),
DATABASE_URL: z.string().url(),
JWT_SECRET: z.string().min(32),
SESSION_SECRET: z.string().min(32),
OPENAI_API_KEY: z.string().optional(),
STRIPE_SECRET_KEY: z.string().optional(),
});
export const env = envSchema.parse(process.env);
export type Env = z.infer<typeof envSchema>;
zod - Schema validation for environment variables.env.example to .env.localenv in your application filesimport { env } from './env';
// Type-safe access to environment variables
const dbUrl = env.DATABASE_URL; // string
const secret = env.NEXTAUTH_SECRET; // string
FAQs
Environment variable setup with Zod validation for Next.js, React, Vue, Angular, Svelte, Express, Fastify, Node.js projects
We found that @scaffit/env demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.