
Research
Two Malicious Rust Crates Impersonate Popular Logger to Steal Wallet Keys
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
babel-plugin-dotenv-import
Advanced tools
Load environment variables using
import
statements.
$ npm install babel-plugin-dotenv-import
.babelrc
{
"plugins": [
["dotenv-import", {
"moduleName": "@env",
"path": ".env",
"blocklist": null,
"allowlist": null,
"safe": false,
"allowUndefined": false
}]
]
}
.env
API_URL=https://api.example.org
API_TOKEN=
In users.js
import {API_URL, API_TOKEN} from "@env"
fetch(`${API_URL}/users`, {
headers: {
'Authorization': `Bearer ${API_TOKEN}`
}
})
It is possible to limit the scope of env variables that will be imported by specifying a allowlist
and/or a blocklist
as an array of strings.
{
"plugins": [
["dotenv-import", {
"blocklist": [
"GITHUB_TOKEN"
]
}]
]
}
{
"plugins": [
["dotenv-import", {
"allowlist": [
"API_URL",
"API_TOKEN"
]
}]
]
}
Enable safe mode to only allow environment variables defined in the .env
file. This will completely ignore everything that is already defined in the environment.
The .env
file has to exist.
{
"plugins": [
["dotenv-import", {
"safe": true
}]
]
}
Allow importing undefined variables, their value will be undefined
.
{
"plugins": [
["dotenv-import", {
"allowUndefined": true
}]
]
}
import {UNDEFINED_VAR} from '@env'
console.log(UNDEFINED_VAR === undefined) // true
When false
(default behavior), an error will be thrown.
When using with babel-loader
with caching enabled you will run into issues where environment changes won’t be picked up.
This is due to the fact that babel-loader
computes a cacheIdentifier
that does not take your environment into account.
You can easily clear the cache:
rm -rf node_modules/.cache/babel-loader/*
Or you can override the default cacheIdentifier
to include some of your environment variables.
Based on David Chang’s works on babel-plugin-dotenv.
╚⊙ ⊙╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
╚═(███)═╝
FAQs
Load environment variables using import statements.
The npm package babel-plugin-dotenv-import receives a total of 9,120 weekly downloads. As such, babel-plugin-dotenv-import popularity was classified as popular.
We found that babel-plugin-dotenv-import demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Socket uncovers malicious Rust crates impersonating fast_log to steal Solana and Ethereum wallet keys from source code.
Research
A malicious package uses a QR code as steganography in an innovative technique.
Research
/Security News
Socket identified 80 fake candidates targeting engineering roles, including suspected North Korean operators, exposing the new reality of hiring as a security function.