
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
A powerful environment management tool for Node.js applications. Manage, encrypt, and switch between different environment configurations with ease.
# Install globally
npm install -g envpro
# Or install as a dev dependency
npm install --save-dev envpro
Initialize envpro in your project:
envpro init
Create your first environment:
envpro new development
Add your environment variables:
# Edit .env.development
DATABASE_URL=postgres://user:pass@localhost:5432/dev_db
API_KEY=your_api_key
Encrypt your environment:
envpro encrypt development
Use the environment in your code:
import { useEnv, getEnvVar } from 'envpro/utils/env-loader';
// Load environment variables
await useEnv({
environment: 'development'
});
// Access variables
const dbUrl = getEnvVar('DATABASE_URL');
# Initialize project
mkdir my-app
cd my-app
npm init -y
npm install --save-dev envpro typescript @types/node
// tsconfig.json
{
"compilerOptions": {
"target": "ES2020",
"module": "commonjs",
"outDir": "./dist",
"rootDir": "./src",
"strict": true,
"esModuleInterop": true
}
}
envpro init
envpro new development
envpro new production
# .env.development
DATABASE_URL=postgres://user:pass@localhost:5432/dev_db
API_KEY=dev_api_key
PORT=3000
NODE_ENV=development
# .env.production
DATABASE_URL=postgres://user:pass@prod-db:5432/prod_db
API_KEY=prod_api_key
PORT=80
NODE_ENV=production
envpro encrypt development
envpro encrypt production
// src/index.ts
import { useEnv, getEnvVar } from 'envpro/utils/env-loader';
async function main() {
// Load environment variables
await useEnv({
environment: process.env.NODE_ENV || 'development'
});
// Access variables
const dbUrl = getEnvVar('DATABASE_URL');
const port = getEnvVar('PORT') || '3000';
const apiKey = getEnvVar('API_KEY');
console.log('Database URL:', dbUrl);
console.log('Port:', port);
console.log('API Key:', apiKey ? '***' : 'Not set');
}
main().catch(console.error);
# Build
npm run build
# Run in development
NODE_ENV=development node dist/index.js
# Run in production
NODE_ENV=production node dist/index.js
import { useEnv, getEnvVar } from 'envpro/utils/env-loader';
interface EnvSchema {
DATABASE_URL: string;
API_KEY: string;
PORT?: string;
}
async function validateEnv(): Promise<EnvSchema> {
await useEnv();
const requiredVars = ['DATABASE_URL', 'API_KEY'];
for (const key of requiredVars) {
if (!getEnvVar(key)) {
throw new Error(`Missing required environment variable: ${key}`);
}
}
return {
DATABASE_URL: getEnvVar('DATABASE_URL')!,
API_KEY: getEnvVar('API_KEY')!,
PORT: getEnvVar('PORT')
};
}
import { useEnv, getEnvVar } from 'envpro/utils/env-loader';
class Config {
private static instance: Config;
private env: string;
private constructor() {
this.env = process.env.NODE_ENV || 'development';
}
static async getInstance(): Promise<Config> {
if (!Config.instance) {
Config.instance = new Config();
await useEnv({
environment: Config.instance.env,
override: true
});
}
return Config.instance;
}
getDatabaseUrl(): string {
return getEnvVar('DATABASE_URL')!;
}
getApiKey(): string {
return getEnvVar('API_KEY')!;
}
getPort(): number {
return parseInt(getEnvVar('PORT') || '3000', 10);
}
}
// Usage
async function main() {
const config = await Config.getInstance();
console.log('Database URL:', config.getDatabaseUrl());
console.log('Port:', config.getPort());
}
import { useEnv } from 'envpro/utils/env-loader';
describe('My Test Suite', () => {
beforeAll(async () => {
await useEnv({
environment: 'test',
override: true
});
});
it('should use test environment variables', () => {
expect(process.env.NODE_ENV).toBe('test');
// ... rest of your test
});
});
Key Management:
.envpro/keys/File Security:
.env files.envpro/keys/ in a secure locationBackup Strategy:
envpro backupKey Not Found
❌ No encryption key found!
💡 Please ensure:
1. The key exists in .envpro/keys/
2. Or set it as an environment variable: ENCRYPTION_KEY=your_key
Solution: Run envpro encrypt <environment> to generate a new key.
File Not Found
❌ Environment file not found: .env.production
Solution: Create the environment first using envpro new production.
Decryption Failed
❌ Decryption failed: Invalid encryption key
Solution: Ensure you're using the correct key for the environment.
MIT License - feel free to use this tool in your projects!
If you find this tool helpful, please consider giving it a ⭐️ on GitHub!
Made with ❤️ by [Avijit Sen]
FAQs
CLI tool for managing environment files with TypeScript support
We found that envpro-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.