
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
The environment variable detective your codebase needs
A command-line tool to analyze environment variables in your project and manage them efficiently.
process.env and import.meta.env--all flagnpm install -g chkenv
chkenv [options]
Options:
-h, --help Show help
-v, --version Show version
-d, --default Run with default options
-p, --path <path> Directory to analyze (default: ./)
-c, --config <path> Configuration file name (default: .env.local)
-a, --all Include commented environment variables
--cleanup Enable cleanup process for unused variables
When run without the -d flag, chkenv will prompt for:
chkenv -d
chkenv --all
chkenv --path src/api
chkenv --config .env.production
chkenv --cleanup
chkenv --config .env.production --path src/api --all --cleanup
When cleaning up unused variables, chkenv offers three backup options:
Example backup workflow:
$ chkenv --cleanup
🔍 Analyzing Environment Variables...
❌ Unused Variables:
- API_KEY
- STRIPE_SECRET
✨ Summary:
- Files scanned: 42
- Total env variables: 15
- Used variables: 13
- Unused variables: 2
- Undeclared variables: 0
🧹 Cleanup Options
? What would you like to do with unused environment variables?
> Keep them as is
Remove them
Comment them out
? Are you sure you want to comment out 2 environment variables? (y/N)
? A backup file already exists. What would you like to do?
> Overwrite existing backup
Create new backup file
Specify custom backup name
✨ Environment file updated successfully!
Backup created at: .env.local.backup
Commented out variables:
- # API_KEY
- # STRIPE_SECRET
Contributions are welcome! Please feel free to submit a Pull Request.
For any help or queries, you can reach out to me on X | LinkedIn | Peerlist.
FAQs
Check environment variables
We found that chkenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.