Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
dotenv-filter-cli
Advanced tools
Reverse of dotenv; filter env variables and output them in the dotenv format
This is a very small CLI tool to filter environment variables from process.env
.
You can kinda see this as the reverse of dotenv; it processes all your current env variables, allows you to filter on them and outputs it as if it were a dotenv file.
My specific use case is that when I run Zeit Now in a CI tool like Travis, I want to give it only the environment variables that start with BACKEND_
, like BACKEND_SECRET
. The only alternative I saw is to pass every environment variable with, -e BACKEND_SECRET
etc. That is not maintainable when you have 10+ variables.
Install with npm i -g dotenv-filter-cli
$ dotenv-filter --prefix=BACKEND_
BACKEND_SECRET="xxx"
BACKEND_APP_URL="https://example.com"
Or save to a file directly:
$ dotenv-filter --prefix=BACKEND_ > .env
Or if your naming scheme uses consistent suffixes instead of prefixes:
$ dotenv-filter --suffix=_APP
SECRET_APP="xxx"
Or maybe you want to filter on multiple suffixes:
$ dotenv-filter --suffix=_APP --suffix=MAIL
SECRET_APP="xxx"
FROM_MAIL="kees@example.com"
Example usage with Zeit Now (note: this is not specific in any way to Zeit):
$ dotenv-filter --prefix=BACKEND > .env.now
$ now --dotenv .env.now
FAQs
Reverse of dotenv; filter env variables and output them in the dotenv format
We found that dotenv-filter-cli demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.