Security News
JSR Working Group Kicks Off with Ambitious Roadmap and Plans for Open Governance
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
loose-envify
Advanced tools
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
The loose-envify npm package is a fast (loose) selective process.env replacer using js-tokens instead of an AST. It is commonly used to replace process.env.NODE_ENV with a static value allowing for dead code elimination in browser bundles.
Environment Variable Replacement
Replaces instances of process.env.NODE_ENV with a user-defined string, allowing conditional code to be statically evaluated and potentially removed by minifiers.
"if (process.env.NODE_ENV !== 'production') { console.log('Debug info') }"
envify is similar to loose-envify but performs a full AST analysis which makes it more accurate but slower. It replaces environment variables in the same way.
dotenv loads environment variables from a .env file into process.env, but it does not replace them in the code during the build process like loose-envify does.
cross-env allows you to set and use environment variables across platforms but does not replace them in the code. It's used more for setting up the environment rather than for code builds.
Fast (and loose) selective process.env
replacer using js-tokens instead of an AST. Works just like envify but much faster.
console.log(`the current env is ${process.env.NODE_ENV}`);
console.log(process./*won't*/env./*work*/NODE_ENV);
loose-envify has the exact same interface as envify, including the CLI.
envify:
$ for i in {1..5}; do node bench/bench.js 'envify'; done
708ms
727ms
791ms
719ms
720ms
loose-envify:
$ for i in {1..5}; do node bench/bench.js '../'; done
51ms
52ms
52ms
52ms
52ms
FAQs
Fast (and loose) selective `process.env` replacer using js-tokens instead of an AST
We found that loose-envify demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
At its inaugural meeting, the JSR Working Group outlined plans for an open governance model and a roadmap to enhance JavaScript package management.
Security News
Research
An advanced npm supply chain attack is leveraging Ethereum smart contracts for decentralized, persistent malware control, evading traditional defenses.
Security News
Research
Attackers are impersonating Sindre Sorhus on npm with a fake 'chalk-node' package containing a malicious backdoor to compromise developers' projects.