Research
Security News
Malicious npm Package Targets Solana Developers and Hijacks Funds
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
loose-envify
Advanced tools
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
The loose-envify npm package is a fast (loose) selective process.env replacer using js-tokens instead of an AST. It is commonly used to replace process.env.NODE_ENV with a static value allowing for dead code elimination in browser bundles.
Environment Variable Replacement
Replaces instances of process.env.NODE_ENV with a user-defined string, allowing conditional code to be statically evaluated and potentially removed by minifiers.
"if (process.env.NODE_ENV !== 'production') { console.log('Debug info') }"
envify is similar to loose-envify but performs a full AST analysis which makes it more accurate but slower. It replaces environment variables in the same way.
dotenv loads environment variables from a .env file into process.env, but it does not replace them in the code during the build process like loose-envify does.
cross-env allows you to set and use environment variables across platforms but does not replace them in the code. It's used more for setting up the environment rather than for code builds.
Fast (and loose) selective process.env
replacer using js-tokens instead of an AST. Works just like envify but much faster.
console.log(`the current env is ${process.env.NODE_ENV}`);
console.log(process./*won't*/env./*work*/NODE_ENV);
loose-envify has the exact same interface as envify, including the CLI.
envify:
$ for i in {1..5}; do node bench/bench.js 'envify'; done
708ms
727ms
791ms
719ms
720ms
loose-envify:
$ for i in {1..5}; do node bench/bench.js '../'; done
51ms
52ms
52ms
52ms
52ms
FAQs
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
The npm package loose-envify receives a total of 28,915,156 weekly downloads. As such, loose-envify popularity was classified as popular.
We found that loose-envify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A malicious npm package targets Solana developers, rerouting funds in 2% of transactions to a hardcoded address.
Security News
Research
Socket researchers have discovered malicious npm packages targeting crypto developers, stealing credentials and wallet data using spyware delivered through typosquats of popular cryptographic libraries.
Security News
Socket's package search now displays weekly downloads for npm packages, helping developers quickly assess popularity and make more informed decisions.