
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
bare-dotenv
Advanced tools
bare-dotenv is a lightweight adaptation of dotenv specifically designed for the Bare runtime. It loads environment variables from a .env file into the Bare environment using bare-env.
process.env: Uses bare-env instead of Node.js's process.env (which doesn't exist in Bare)-r preload flag like Node.jsnpm install bare-dotenv --save
Create a .env file in the root of your project:
S3_BUCKET="YOURS3BUCKET"
SECRET_KEY="YOURSECRETKEYGOESHERE"
As early as possible in your application, import and configure bare-dotenv:
require("bare-dotenv").config();
Or using ES6:
import "bare-dotenv/config";
That's it! Your environment variables are now available through bare-env:
const env = require("bare-env");
console.log(env.S3_BUCKET); // "YOURS3BUCKET"
console.log(env.SECRET_KEY); // "YOURSECRETKEYGOESHERE"
const dotenv = require("bare-dotenv");
// Load with custom options
const result = dotenv.config({
path: "/custom/path/to/.env",
debug: true,
override: true,
});
if (result.error) {
throw result.error;
}
console.log(result.parsed);
const dotenv = require("bare-dotenv");
// Load multiple files in order
dotenv.config({
path: [".env.local", ".env"],
});
config(options)Loads environment variables from .env file(s) into the Bare environment.
path (string|array): Path to .env file(s). Default: '.env'encoding (string): File encoding. Default: 'utf8'debug (boolean): Enable debug logging. Default: falseoverride (boolean): Override existing environment variables. Default: falsequiet (boolean): Suppress logging. Default: trueconst dotenv = require("bare-dotenv");
const result = dotenv.config({
path: ".env.production",
debug: true,
override: true,
});
if (result.error) {
console.error("Error loading .env file:", result.error);
}
parse(src)Parse environment variables from a string or buffer.
const dotenv = require("bare-dotenv");
const parsed = dotenv.parse("HELLO=world\nFOO=bar");
console.log(parsed); // { HELLO: 'world', FOO: 'bar' }
populate(target, parsed, options)Populate a target object with parsed environment variables.
const dotenv = require("bare-dotenv");
const env = require("bare-env");
const parsed = { HELLO: "world" };
dotenv.populate(env, parsed, { override: true });
You can configure bare-dotenv using environment variables:
# Set custom path
DOTENV_CONFIG_PATH=/custom/path/.env
# Enable debug mode
DOTENV_CONFIG_DEBUG=true
# Override existing variables
DOTENV_CONFIG_OVERRIDE=true
# Set encoding
DOTENV_CONFIG_ENCODING=latin1
# Suppress logging
DOTENV_CONFIG_QUIET=true
# Basic key-value pairs
S3_BUCKET="YOURS3BUCKET"
SECRET_KEY="YOURSECRETKEYGOESHERE"
DATABASE_URL="postgres://user:pass@localhost/db"
# Multiline values (>= v15.0.0)
PRIVATE_KEY="-----BEGIN RSA PRIVATE KEY-----
MIIEpAIBAAKCAQEA...
-----END RSA PRIVATE KEY-----"
# This is a comment
SECRET_KEY=YOURSECRETKEYGOESHERE # inline comment
SECRET_HASH="something-with-a-#-hash"
# Single quotes
SINGLE_QUOTE='quoted value'
# Double quotes (supports \n for newlines)
MULTILINE="new\nline"
# Backticks
BACKTICK_KEY=`This has 'single' and "double" quotes inside`
// index.js
require("bare-dotenv").config();
const env = require("bare-env");
console.log(`Hello ${env.USER_NAME}!`);
console.log(`Database: ${env.DATABASE_URL}`);
// config.js
const dotenv = require("bare-dotenv");
const env = require("bare-env");
// Load environment-specific config
const envType = env.BARE_ENV || "development";
dotenv.config({
path: `.env.${envType}`,
debug: true,
override: true,
});
// test.js
const test = require("brittle");
const dotenv = require("bare-dotenv");
test("loads environment variables", function (t) {
dotenv.config({ path: "tests/.env.test" });
const env = require("bare-env");
t.is(env.TEST_VAR, "test_value");
});
Bare-dotenv is designed to be lightweight and focused on core functionality. Encryption features were removed to keep the module simple and avoid dependencies on bare-crypto which may not support all required crypto methods.
Bare runtime doesn't support the -r preload flag like Node.js. You need to explicitly require and configure bare-dotenv in your application code.
bare-env instead of process.envNo, this module is specifically designed for the Bare runtime. For Node.js, use the original dotenv package.
Variable expansion is not supported in bare-dotenv. Consider using dotenvx for advanced features like variable expansion and encryption.
See CONTRIBUTING.md
See LICENSE
This project is based on the original dotenv by motdotla, adapted for the Bare runtime.
Projects that use bare-dotenv often use the keyword "bare-dotenv" on npm.
FAQs
Loads environment variables from .env file
We found that bare-dotenv demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.