
Research
Security News
Malicious PyPI Package Exploits Deezer API for Coordinated Music Piracy
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
create-dotenv
Advanced tools
A Javascript (nodejs) port of the Go dotenv project (which loads env vars from a .env file).
From the original Library:
Storing configuration in the environment is one of the tenets of a twelve-factor app. Anything that is likely to change between deployment environments–such as resource handles for databases or credentials for external services–should be extracted from the code into environment variables.
But it is not always practical to set environment variables on development machines or continuous integration servers where multiple projects are run. Dotenv load variables from a .env file into ENV when the environment is bootstrapped.
It can be used as a library (for loading in env for your own daemons etc.)
npm i @jsdotenv/core
Add your application configuration to your .env
file in the root of your project:
S3_BUCKET=YOURS3BUCKET
SECRET_KEY=YOURSECRETKEYGOESHERE
Then in your Nodejs app you can do something like
import dotenv from "@jsdotenv/core";
dotenv.load([__dirname + "/.env"]);
console.log(process.env["S3_BUCKET"]);
While .env
in the project root is the default, you don't have to be constrained, both examples below are 100% legit
If you want to be really fancy with your env file you can do comments and exports (below is a valid env file)
# I am a comment and that is OK
SOME_VAR=someval
FOO=BAR # comments at line end are OK too
export BAR=BAZ
Or finally you can do YAML(ish) style
FOO: bar
BAR: baz
FAQs
Loads environment variables from .env file
The npm package create-dotenv receives a total of 14 weekly downloads. As such, create-dotenv popularity was classified as not popular.
We found that create-dotenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.
Security News
Newly introduced telemetry in devenv 1.4 sparked a backlash over privacy concerns, leading to the removal of its AI-powered feature after strong community pushback.