
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
env-and-files
Advanced tools
Load configuration from environmental variables and files.
According to The Twelve-Factor App, configuration should come from environmental variables. But since environmental variables can leak easily, some people use secrets for sensitive information. This module is made to support either with minimal set-up.
npm install env-and-files
Or, with yarn:
$ yarn add env-and-files
const {loadConfig} = require('env-and-files');
loadConfig({
postgresPassword: {
filePath: '/secrets/password',
},
postgresUrl: {
format: (value) => new URL(value),
variableName: 'POSTGRES_URL',
},
postgresUsername: {
defaultValue: 'postgres',
filePath: '/secrets/username',
},
})
.then((config) => {
// "config" will be an object map of configuration properties.
console.log(config);
})
.catch((error) => {
// If any of the required properties cannot be loaded, the Promise will reject.
console.error(error);
});
Load configuration. Returns a Promise that will resolve to the loaded configuration, or reject if the configuration was invalid.
Type: Object
An object map of configuration and where to find it. By default, all configuration properties are required. See usage for examples of config maps.
Load configuration, synchronously. Returns the loaded configuration, or throws if the configuration was invalid.
Type: Object
Same as the asynchronous version.
MIT © Matthew Fernando Garcia
FAQs
Load configuration from environmental variables and files.
We found that env-and-files demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.