
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
node-env-schema
Advanced tools
Type-safe env variable validator for Node.js, React, Vue, serverless. Validate, parse, and type your environment variables with runtime safety.
Type-safe Environment Variable Validator for Node.js, Serverless, and other process.env based platforms
node-env-schema helps you validate, parse, and type your environment variables at runtime with TypeScript support.
It ensures that your environment variables are:
string, number, boolean, url, uri, port, or enum-like arrays)⚡ It works only in environments where process.env is available — like Node.js, Serverless, backend services, etc.
🛑 It does NOT work directly inside the browser (e.g., pure Vite frontends) unless you expose environment variables at build time.
npm install node-env-schema
or
yarn add node-env-schema
// env.ts
import { defineEnv, validateEnv } from 'node-env-schema';
const schema = defineEnv({
NODE_ENV: ['development', 'production', 'test'],
PORT: { type: 'port', default: 3000 },
DATABASE_URL: 'url',
ENABLE_FEATURE: { type: 'boolean', default: false },
});
export const env = validateEnv(schema);
✅ env will now be a fully typed and validated object.
import { env } from './env';
console.log(env.NODE_ENV); // 'development' | 'production' | 'test'
console.log(env.PORT); // number
console.log(env.DATABASE_URL); // string (validated URL)
console.log(env.ENABLE_FEATURE); // boolean
If any environment variable is missing, incorrectly typed, or invalid, node-env-schema will throw an error at runtime, helping you catch configuration issues early.
defineEnv(schema)Defines the environment schema.
string, number, boolean, url, uri, port){ type: EnvType, default?: any } to specify default valuesvalidateEnv(schema)process.env.| Type | Validation Details |
|---|---|
string | Any non-empty string |
number | Parsed as a number, throws if invalid |
boolean | Only accepts 'true' or 'false' |
url | Validated using URL constructor |
uri | Loosely validated URI format (scheme:rest) |
port | Integer between 0 and 65535 |
string[] | Restricts value to one of the given allowed strings (enum) |
import { defineEnv, validateEnv } from 'node-env-schema';
const schema = defineEnv({
API_URL: 'url',
NODE_ENV: ['development', 'production', 'test'],
DEBUG_MODE: { type: 'boolean', default: false },
TIMEOUT: { type: 'number', default: 5000 },
SERVICE_PORT: 'port',
});
export const env = validateEnv(schema);
console.log(env.API_URL); // Valid URL string
console.log(env.NODE_ENV); // 'development' | 'production' | 'test'
console.log(env.DEBUG_MODE); // true or false
console.log(env.TIMEOUT); // number
console.log(env.SERVICE_PORT); // number (valid port)
If process.env.API_URL is invalid or missing, your application will immediately fail with a clear error like:
Expected environment variable API_URL to be a valid URL, but got "invalid-url"
process.env to be available.Example for Vite (build-time):
// vite.config.ts
define: {
'process.env': process.env, // manually inject environment variables
}
You should call validateEnv at the very beginning of your app (before connecting to databases, starting servers, etc.).
Example:
import { env } from './env';
// Safe to continue after validation
startServer(env.PORT);
Missing variable
Error: Missing required environment variable: DATABASE_URL
Invalid number
Error: Expected environment variable PORT to be a number, but got "abc"
Invalid URL
Error: Expected environment variable API_URL to be a valid URL, but got "not_a_url"
Invalid enum value
Error: Expected environment variable NODE_ENV to be one of [development, production, test], but got "staging"
MIT License © 2025 Sayantan Ghosh
If you like node-env-schema, consider giving it a ⭐ on GitHub!
FAQs
Type-safe env variable validator for Node.js, React, Vue, serverless. Validate, parse, and type your environment variables with runtime safety.
We found that node-env-schema demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.