
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
@zentered/envsync
Advanced tools
EnvSync is an attempt to make it easier for developers to initialize an
environment or update environment variables with on a single source of truth.
EnvSync currently works with Google Cloud Platform (Secrets Manager). It reads
the environment configuration from an .env.example file that is commonly used
to help developers get started with a new project, fetches the values from the
Google Cloud Platform (Secrets Manager) and writes them to a .env file.
For example, if you have the following .env.example file:
GCP_PROJECT=myproject-dev
API_URL=http://localhost:3000
AUTH0_CLIENT_SECRET=envsync//auth0-api-client-secret/latest
Will write the following .env file:
GCP_PROJECT=myproject-dev
API_URL=http://localhost:3000
AUTH0_CLIENT_SECRET=secret-value-from-gcp-project
Important: The first variable in the example should be GCP_PROJECT as
we're using that to determine the right project. A keyfile.json
(Create and manage service account keys)
is required in the same folder as the .env.example file.
npm install @zentered/envsync
# pnpm i @zentered/envsync
# yarn add @zentered/envsync
EnvSync:.env.example file (use envsync//[variable] to indicate a variable that
should be fetched from Secrets Manager). The first variable should be
GCP_PROJECT with the valid project idkeyfile.json from a Google Cloud Platform service account with Secrets
Manager API enabled, and permission to read secretsEnvSync is a CLI tool. You can run it with npx envsync or add it as a
script in package.json:
{
"scripts": {
"envsync": "envsync"
}
}
.env file:Note: this is an anti-pattern and should be avoided. Environment variables belong in the environment, not in the codebase. See 12 factor app.
.env files, you can provide the filename as an
argument. The .env example file must end in .examplenpx envsync .env.development.example will create .env.developmentSee CONTRIBUTING.
See LICENSE.
FAQs
Synchronize .env files with Google Cloud Secrets Manager
We found that @zentered/envsync demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.