
Security News
The Hidden Blast Radius of the Axios Compromise
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.
๐ Beautiful CLI tool to push environment variables to Cloudflare Pages/Workers
Beautiful CLI tool to push environment variables to Cloudflare Pages/Workers
EnvCF is a modern, user-friendly CLI tool that makes it super easy to sync your environment variables from .env files to Cloudflare Pages or Workers. No more manual copying and pasting!
wrangler.toml or wrangler.jsonc configuration.env, .env.local, .env.production, etc.npm install -g envcf
# or
pnpm add -g envcf
# or
yarn global add envcf
npx envcf
Navigate to your project directory and run:
envcf
The CLI will guide you through:
wrangler.toml or wrangler.jsonc.env files to use# Dry run - see what would happen without making changes
envcf --dry-run
# Use custom env file
envcf --file .env.custom
# Use custom wrangler config
envcf --config wrangler.custom.toml
# Show help
envcf --help
EnvCF integrates seamlessly with cfman for managing multiple Cloudflare accounts:
# First, set up your accounts with cfman
npx cfman token add --name production --token cf_your_production_token
npx cfman token add --name staging --token cf_your_staging_token
# Then use envcf with specific accounts
envcf --account production # Deploy to production account
envcf --account staging # Deploy to staging account
# You can combine with other options
envcf --account production --dry-run --file .env.prod
Benefits of cfman integration:
Wrangler CLI installed and authenticated:
npm install -g wrangler
wrangler login
Optional: cfman for multi-account management:
npm install -g cfman
cfman token add --name production --token your_token
Project structure with either:
wrangler.toml filewrangler.jsonc fileEnvironment files like:
.env.env.local.env.production.env.preview$ envcf
๐ฅ๏ธ EnvCF - Environment Variables to Cloudflare
๐ Looking for wrangler configuration...
โ
Found config: wrangler.toml
๐ฆ Project: my-awesome-app
? Which environment do you want to deploy to?
โฏ ๐ Production
๐งช Preview
๐ Looking for environment files...
? Which environment files do you want to use?
โฏ โ ๐ .env
โ ๐ .env.local
โ ๐ All files
๐ Parsing environment variables...
โ
Found 12 environment variables
๐ Environment variables to be pushed:
โข DATABASE_URL (from .env)
โข API_KEY (from .env)
โข SECRET_TOKEN (from .env.local)
...
? Push these 12 variables to production? Yes
๐ Pushing to Cloudflare...
๐ Authenticated with Cloudflare
โ
DATABASE_URL
โ
API_KEY
โ
SECRET_TOKEN
...
๐ Results:
โ
Success: 12
โจ All environment variables pushed successfully!
EnvCF works with standard Wrangler configuration files:
wrangler.toml:
name = "my-app"
compatibility_date = "2023-12-01"
[env.preview]
# Preview environment config
[env.production]
# Production environment config
wrangler.jsonc:
{
"name": "my-app",
"compatibility_date": "2023-12-01",
"env": {
"preview": {},
"production": {}
}
}
Standard .env file format:
# Database
DATABASE_URL=postgresql://localhost:5432/mydb
DATABASE_POOL_SIZE=10
# API Keys
STRIPE_SECRET_KEY=sk_test_...
SENDGRID_API_KEY=SG....
# Feature Flags
ENABLE_ANALYTICS=true
DEBUG_MODE=false
Contributions are welcome! Please feel free to submit a Pull Request.
MIT ยฉ Shayan Moradi
Happy deploying! ๐
FAQs
๐ Beautiful CLI tool to push environment variables to Cloudflare Pages/Workers
We found that envcf demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the projectโs GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.