Security News
Research
Data Theft Repackaged: A Case Study in Malicious Wrapper Packages on npm
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
babel-plugin-transform-inline-environment-variables
Advanced tools
Inline environment variables.
The babel-plugin-transform-inline-environment-variables package is a Babel plugin that allows you to inline environment variables into your code at build time. This can be useful for injecting configuration values directly into your JavaScript code, making it easier to manage environment-specific settings.
Inline Environment Variables
This feature allows you to replace occurrences of process.env.<VARIABLE_NAME> with the actual value of the environment variable at build time. For example, if you have an environment variable named API_URL, it will be inlined into your code.
const apiUrl = process.env.API_URL;
Configuration via Babel Config
You can configure the plugin in your Babel configuration file (e.g., .babelrc or babel.config.js). This makes it easy to integrate into your existing Babel setup.
{
"plugins": [
"transform-inline-environment-variables"
]
}
dotenv is a popular package for loading environment variables from a .env file into process.env. Unlike babel-plugin-transform-inline-environment-variables, dotenv does not inline the variables at build time but loads them at runtime.
babel-plugin-transform-define allows you to replace identifiers with constant values at build time. It is more general-purpose compared to babel-plugin-transform-inline-environment-variables, which is specifically designed for inlining environment variables.
Inline environment variables
// assuming process.env.NODE_ENV is actually "development"
process.env.NODE_ENV;
"development";
npm install babel-plugin-transform-inline-environment-variables --save-dev
.babelrc
(Recommended).babelrc
// without options
{
"plugins": ["transform-inline-environment-variables"]
}
// with options
{
"plugins": [
["transform-inline-environment-variables", {
"include": [
"NODE_ENV"
]
}]
]
}
babel --plugins transform-inline-environment-variables script.js
require("@babel/core").transform("code", {
plugins: ["transform-inline-environment-variables"]
});
include
- array of environment variables to includeexclude
- array of environment variables to excludeFAQs
Inline environment variables.
We found that babel-plugin-transform-inline-environment-variables demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 5 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Research
The Socket Research Team breaks down a malicious wrapper package that uses obfuscation to harvest credentials and exfiltrate sensitive data.
Research
Security News
Attackers used a malicious npm package typosquatting a popular ESLint plugin to steal sensitive data, execute commands, and exploit developer systems.
Security News
The Ultralytics' PyPI Package was compromised four times in one weekend through GitHub Actions cache poisoning and failure to rotate previously compromised API tokens.