
Research
2025 Report: Destructive Malware in Open Source Packages
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.
gulp-env-loader
Advanced tools
A gulp plugin for loading environment variables and replacing them in the contents of files.
A gulp plugin for loading environment variables and replacing them in file contents.
It can load environment variables from a specified configuration file or from the default .env file.
It uses dotenv to load additional environment variables from the following files in your environment directory, and it also statically replaces environment variables that appear in the file.
.env # loaded in all cases
.env.local # loaded in all cases, but ignored by git
.env.[mode] # only loaded in specified mode
.env.[mode].local # only loaded in specified mode, but ignored by git
ignores
.*.local, so you also need to add it to your project's.gitignorefile:
# local env files
.env.local
.env.*.local
npm install -D gulp-env-loader
Node.js > 12
.env file in the root directory of your project, or create different .env files for different environments, such as .env.development, .env.production, etc.# .env configuration
APP_MODE="development"
APP_API="http://test-api.com"
gulpfile.jsconst gulp = require('gulp')
const envInject = require('gulp-env-loader')() //!recommended to put at the beginning and execute immediately
// Output the configured environment variables
console.log('env', envInject.env)
gulp.task('build', function() {
return gulp.src('./src/*.js', { sourcemaps: true })
.pipe(envInject())
.pipe(gulp.dest('./dist', { sourcemaps: '.' }))
})
mode at runtime, which will automatically load the corresponding environment variable configuration file.gulp build --mode=development
require('gulp-env-loader')([config])
An optional configuration object or configuration file path.
If it is a string, it represents the configuration file path. If it is an object, it can contain the following properties:
path: Configuration file path, default is .envmode: Environment mode name.modekey: Environment mode key name, default is modeenvInject([option])
Creates a through2 stream for replacing environment variables in file contents.
isVar: Replaces environment variables with their corresponding string representations. Default is true.FAQs
A gulp plugin for loading environment variables and replacing them in the contents of files.
The npm package gulp-env-loader receives a total of 7 weekly downloads. As such, gulp-env-loader popularity was classified as not popular.
We found that gulp-env-loader demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Destructive malware is rising across open source registries, using delays and kill switches to wipe code, break builds, and disrupt CI/CD.

Security News
Socket CTO Ahmad Nassri shares practical AI coding techniques, tools, and team workflows, plus what still feels noisy and why shipping remains human-led.

Research
/Security News
A five-month operation turned 27 npm packages into durable hosting for browser-run lures that mimic document-sharing portals and Microsoft sign-in, targeting 25 organizations across manufacturing, industrial automation, plastics, and healthcare for credential theft.