
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
load environment variables from .env file, into process.env
in production mode, use real environment variables instead
npm i -D dotenv-ts
require('dotenv-ts').config()
or with options
require('dotenv-ts').config(options)
| Key | required | Type | Default | Description |
|---|---|---|---|---|
| dirname | no | string | process.cwd() | path to find .env file |
| mode | no | string | process.env.NODE_ENV or "dev" | mode to determine additional .env file's name. one of prod, dev, test, debug |
| canOverwrite | no | boolean | false | specify whether .env variables can overwrite process.env. if not, conflicting key will logged and not applied. |
| priority | yes | "local" or "mode" or undefined | "local" | determines which file's value will be used when .env.${mode} and .env.local has same key. if unspecified(undefined) and has conflicting key, error will thrown |
| variables | no | Object | process.env | key-value store for variables - used to resolve variables |
| shareVariables | yes | boolean | true | share variables cross file (can reference variable in another file) |
Required options' default value is used if no option provided.
WARN: If option object is passed but required option is not set, the value will be undefined which can lead to unexpected behavior
load environment variable from .env file into process.env
supports multiline and variable resolution also
There may be any breaking changes before the first stable version.
FAQs
load environment variables from .env file, into process.env
The npm package dotenv-ts receives a total of 3 weekly downloads. As such, dotenv-ts popularity was classified as not popular.
We found that dotenv-ts demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.