
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
The Envault CLI allows you to connect to your Envault server and sync its credentials to your local .env file.
To use the Envault CLI, you must have Node.js installed on your computer.
On your Envault dashboard, you will find an initialization command for each environment, which you can run to establish a connection to your Envault server, and pull your variables. This command only needs to be run the first time you connect your .env to Envault. An example initialization command:
npx envault vault.envault.dev 84632 iCNaGGLou6v0mRas
After you've run your environment initialization command for the first time, you can pull your .env again easily:
npx envault
By default, Envault will not pull variables that are not already present in your .env file. To enable this behaviour, use the --constructive flag:
npx envault --constructive
You are able to customise the name of your .env file using the --filename flag:
npx envault vault.envault.dev 84632 iCNaGGLou6v0mRas --filename=.myenv
The Envault CLI will sometimes prompt you to confirm your actions, especially those made in constructive mode. To bypass these prompts, use the --force flag:
npx envault --force
You can store multiple environments instead of overwriting when authenticating a new environment.
You are able to sync a specific .env by providing the server and environment ID. This is especially useful if you have multiple .env files. For example:
npx envault envault.server.test 1 llT8J6tEDbtJgSln
npx envault envault.server.test 2 BXYtZdNkQjtWSqE6
Now, you may sync each environment:
npx envault // Will still sync .env from "1"
npx envault envault.server.test 2 --filename=.env.settings // Will sync .env.settings from "2"
If no server and environment provided it will default to the first environment that was added.
🐞 If you spot a bug with Envault, please submit a detailed issue, and wait for assistance.
🤔 If you have a question or feature request, please start a new discussion.
🔐 If you discover a vulnerability within Envault, please review our security policy.
FAQs
Sync your .env file with Envault.
We found that envault demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.