
Security News
Open Source Maintainers Feeling the Weight of the EU’s Cyber Resilience Act
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.
loose-envify
Advanced tools
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
The loose-envify npm package is a fast (loose) selective process.env replacer using js-tokens instead of an AST. It is commonly used to replace process.env.NODE_ENV with a static value allowing for dead code elimination in browser bundles.
Environment Variable Replacement
Replaces instances of process.env.NODE_ENV with a user-defined string, allowing conditional code to be statically evaluated and potentially removed by minifiers.
"if (process.env.NODE_ENV !== 'production') { console.log('Debug info') }"
envify is similar to loose-envify but performs a full AST analysis which makes it more accurate but slower. It replaces environment variables in the same way.
dotenv loads environment variables from a .env file into process.env, but it does not replace them in the code during the build process like loose-envify does.
cross-env allows you to set and use environment variables across platforms but does not replace them in the code. It's used more for setting up the environment rather than for code builds.
Fast (and loose) selective process.env
replacer using js-tokens instead of an AST. Works just like envify but much faster.
console.log(`the current env is ${process.env.NODE_ENV}`);
console.log(process./*won't*/env./*work*/NODE_ENV);
loose-envify has the exact same interface as envify, including the CLI.
envify:
$ for i in {1..5}; do node bench/bench.js 'envify'; done
708ms
727ms
791ms
719ms
720ms
loose-envify:
$ for i in {1..5}; do node bench/bench.js '../'; done
51ms
52ms
52ms
52ms
52ms
FAQs
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
The npm package loose-envify receives a total of 33,586,194 weekly downloads. As such, loose-envify popularity was classified as popular.
We found that loose-envify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
The EU Cyber Resilience Act is prompting compliance requests that open source maintainers may not be obligated or equipped to handle.
Security News
Crates.io adds Trusted Publishing support, enabling secure GitHub Actions-based crate releases without long-lived API tokens.
Research
/Security News
Undocumented protestware found in 28 npm packages disrupts UI for Russian-language users visiting Russian and Belarusian domains.