Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
doppler-client
Advanced tools
This package is deprecated and no longer functional. Learn how to migrate to the new CLI.
The Doppler Node library provides convenient access to the Doppler API from applications written for only server-side JavaScript.
Install the package with:
npm install @dopplerhq/client --save
The package needs to be configured with your account's api key which is available in your Doppler account, pipeline identifier and the environment name:
Please add these environment variables to your .env
file in the root directory or on your infra provider.
DOPPLER_API_KEY = <API Key>
DOPPLER_PIPELINE = <Pipeline ID>
DOPPLER_ENVIRONMENT = <Environment Name>
Doppler will look for these variables in 3 places with the following priority:
.env
fileThis installation method will expect the DOPPLER_API_KEY
, DOPPLER_PIPELINE
, DOPPLER_ENVIRONMENT
as environment variables.
require("@dopplerhq/client")()
// Rest of Your Application
const example_variable = process.env.EXAMPLE_VARIABLE
This installation method will expect the DOPPLER_API_KEY
, DOPPLER_PIPELINE
, DOPPLER_ENVIRONMENT
in a .env
file.
require("@dopplerhq/client")({
env_filepath: ".env" // Defaults to ".env"
})
// Rest of Your Application
const example_variable = process.env.EXAMPLE_VARIABLE
This installation method will expect the api_key
, pipeline
, environment
as arguments.
require("@dopplerhq/client")({
api_key: process.env.DOPPLER_API_KEY,
pipeline: process.env.DOPPLER_PIPELINE,
environment: process.env.DOPPLER_ENVIRONMENT
})
// Rest of Your Application
const example_variable = process.env.EXAMPLE_VARIABLE
So if Doppler stores my environment variables, where should I keep my Doppler API keys?
That is a great question! We recommend storing your DOPPLER_API_KEY
, DOPPLER_PIPELINE
, and DOPPLER_ENVIRONMENT
in a .env
file or with your infra provider. That means the only variables you should be storing in your local environment are the Doppler keys. All other variables should be be fetched by the Doppler client.
If you would like to disable overriding environment variables, use this follow field.
const doppler = require("@dopplerhq/client")({
override: false
})
// Rest of Your Application
const example_variable = doppler.get("EXAMPLE_VARIABLE")
In the case you would want to ignore specific variables from Doppler, say a port set by Heroku, you can add it the ignore_variables
field.
require("@dopplerhq/client")({
ignore_variables: ["PORT"]
})
The Doppler client accepts a backup_filepath
on init. If provided the client will write
the Doppler variables to a backup file. If the Doppler client fails to connect to our API
endpoint (very unlikely), the client will fallback to the keys provided in the backup file.
require("@dopplerhq/client")({
backup_filepath: "./backup.env"
})
FAQs
The official Doppler Node.js client.
The npm package doppler-client receives a total of 5 weekly downloads. As such, doppler-client popularity was classified as not popular.
We found that doppler-client demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.