
Research
/Security News
Critical Vulnerability in NestJS Devtools: Localhost RCE via Sandbox Escape
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
custom-env
Advanced tools
Custom env is a library built to make development more feasible by allowing multiple .env configurations for different environments.
Custom env is a library built to make development more feasible by allowing multiple .env configurations for different environments. This is done by loading environment variables from a .env.envname file, into the node's process.env
object.
npm install custom-env
Place this at the top of your application
ESM Import
import { env } from "custom-env";
env();
CommonJS Require
require("custom-env").env();
Create a .env
file in your app's root directory and add the environment variables each on new line:
APP_ENV=dev
DB_HOST=localhost
DB_USER=root
DB_PASS=root
Simple! The process.env
is now loaded with the environment variables above.
console.log(process.env.APP_ENV);
console.log(process.env.DB_HOST);
console.log(process.env.DB_USER);
console.log(process.env.DB_PASS);
dev
localhost
root
root
If you want to load from a particular environment, use:
ESM Import
// This loads configuration from staging environment
import { env } from "custom-env";
env("staging");
CommonJS Require
// This loads configuration from staging environment
require("custom-env").env("staging");
Create a .env.staging
file in your app's root directory and add the environment variables each on new line:
APP_ENV=staging
DB_HOST=localhost
DB_USER=root
DB_PASS=root
The process.env
is now loaded with the environment variables above.
This completely overrides process.env.NODE_ENV
Try it out:
NODE_ENV=staging node index.js
console.log(process.env.APP_ENV);
console.log(process.env.DB_HOST);
console.log(process.env.DB_USER);
console.log(process.env.DB_PASS);
staging
localhost
root
root
You can load configuration from the current environment with custom-env by passing the first argument of the env()
method as true
(note: not required in version 2+
) and that's all:
ESM Import
// This Loads the configuration dynamically from to the current enviroment
// Defaults to _dev_ if the environment was set
import { env } from "custom-env";
env("custom-env").env(true);
CommonJS Require
// This Loads the configuration dynamically from to the current enviroment
// Defaults to _dev_ if the environment was set
require("custom-env").env(true);
env()
methodThe env()
method holds three (3) optional arguments.
envname
- Specifies the development name, defaults to dev
or development
,path
- Specifies the directory to find configuration files, defaults to current working directory.defaultEnvFallback
- Specifies whether to fallback to .env
configuration if the specified envname is not found, defaults to true
.ESM Import
import { env } from "custom-env";
env("dev", "path/to/custom/path");
CommonJS Require
require("custom-env").env("dev", "path/to/custom/path");
The library comes with a type declaration file If you want auto complete for your .env variables
Use dotenv-types-generator it will generate a .env.d.ts file containing all your variables
Usage:
npx dotenv-types-generator
You can also leverage the dotenv-expand
extension to use ENV variable expansion inside your .env
files.
For example:
IP=127.0.0.1
PORT=1234
APP_URL=http://${IP}:${PORT}
Using the above example .env
file, process.env.APP_URL
would be http://127.0.0.1:1234
.
We strongly recommend that you should not commit and pass .env.production
file in production mode, as this file may contain sensitive information.
Sponsoring and Supporting custom-env
keeps the work going and improvements steady. Buy me a coffe: https://www.buymeacoffee.com/olasheni Thanks in advance!
dotenv-expand
env()
methodenv()
methodFAQs
Custom env is a library built to make development more feasible by allowing multiple .env configurations for different environments.
We found that custom-env demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
/Security News
A flawed sandbox in @nestjs/devtools-integration lets attackers run code on your machine via CSRF, leading to full Remote Code Execution (RCE).
Product
Customize license detection with Socket’s new license overlays: gain control, reduce noise, and handle edge cases with precision.
Product
Socket now supports Rust and Cargo, offering package search for all users and experimental SBOM generation for enterprise projects.