Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
dotenv-mono
Advanced tools
This is a package that permit to load a dotenv even from a children applications or packages of a monorepo. It contains also some additionals features like manipulations and save of the changes on the dotenv file.
This is a package that permit to load a dotenv even from a children applications or packages of a monorepo.
It contains also some additionals features like manipulations and save of the changes on the dotenv file.
The package dotenv-expand
is enabled by default.
├── .env
├── packages
│ ├── my-package
│ │ ├── index.js
│ ├── my-package-2
│ │ ├── index.js
├── app
│ ├── nextjs
│ │ ├── next.config.js
│ ├── angular
│ │ ├── src
│ │ | ├── environment.ts
This package find up, starting from the current process directory, the first file name that match the specific criterias.
Priority | File name |
---|---|
75 | .env.{development,production,test}.local |
50 | .env.local |
25 | .env.{development,production,test} |
1 | .env |
They can be customized on the constructor priorities
property, see the example below.
Install the library from npm or yarn just running one of the following command lines:
npm | yarn |
---|---|
npm install dotenv-mono --save | yarn add dotenv-mono |
const {dotenvLoad} = require("dotenv-mono");
const dotenv = dotenvLoad();
// Same as
const {DotEnv} = require("dotenv-mono");
const dotenv = new DotEnv();
dotenv.load();
// Use .dotenv.server or .dotenv.server.local, etc...
dotenvLoad({extension: "server"});
// You can specify the file path
dotenvLoad({path: "../../configs/.env"});
dotenv-expand
extensiondotenvLoad({expand: false});
// If .dotenv.overwrite is present use it with max priority
dotenvLoad({
priorities: {
".env.overwrite": 100,
},
});
const dotenv = new DotEnv();
dotenv.loadFile(); // Not loading into process
dotenv.save({
"MY_ENV_1": "enjoy",
"MY_ENV_2": "'enjoy quotes'",
"MY_ENV_3": 999,
});
Have an idea? Found a bug? Please raise to ISSUES or PULL REQUEST. Contributions are welcome and are greatly appreciated! Every little bit helps, and credit will always be given.
FAQs
This package permit to have a centralized dotenv on a monorepo. It also includes some extra features such as manipulation and saving of changes to the dotenv file, a default centralized file, and a file loader with ordering and priorities.
The npm package dotenv-mono receives a total of 18,402 weekly downloads. As such, dotenv-mono popularity was classified as popular.
We found that dotenv-mono demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.