
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
nuxt-env inject env vars for your Nuxt app at runtime
Nuxt currently provides a very handy way of injecting environment variables which uses webpack substitution to inject your env vars at build time. This works most of the time, but if your build process is environment-agnostic (e.g. if you build a Docker image on CI and use the same image for staging and production), you end up with a result which has the environment baked into it (meaning that in our example, the docker image would be coupled to the environment it was built in).
This module allows you to read environment variables server side—at runtime—and inject them into your app, meaning your Nuxt bundle is decoupled from your environment variables.
⚠️ WARNING: As with the config.env option in Nuxt config, environment variables used in nuxt-env are exposed client side, so if you store secrets use the secret config option. Read more below. ⚠️
nuxt-env injects your environment variables into your Nuxt app using this.$env.
N.B. If currently use Nuxt's config.env option, fear not—nuxt-env includes those env vars in the $env object.
yarn add nuxt-env
nuxt.config.js and configure:// nuxt.config.js
// Tell nuxt-env which env vars you want to inject
modules: [
'other-nuxt-module',
['nuxt-env', {
keys: [
'TEST_ENV_VAR', // Basic usage—equivalent of { key: 'TEST_ENV_VAR' }
{ key: 'OTHER_ENV_VAR', default: 'defaultValue' } // Specify a default value
{ key: 'THIRD_ENV_VAR', secret: true } // Only inject the var server side
{ key: 'THIRD_ENV_VAR', name: 'MY_ENV_VAR' } // Rename the variable
]
}]
]
Env vars can be injected in a basic way, just by specifying a string in the keys option.
When the provided var is an object, it can have the following attributes:
keyrequired
The name of the environment variable by which it can be accessed in process.env
defaultA default value for the env var in case it's not present in process.env.
secretdefault:
false
When true, this key will only be present server side.
nameChange the name of the env var that gets injected. e.g.: { key: 'API_URL', name: 'API_ENDPOINT' } will read process.env.API_URL and add it as $env.API_ENDPOINT
this.$env in your components:// any-component.vue
export default {
computed: {
testValue () { return this.$env.TEST_VALUE }
}
}
// any-component.vue
export default {
asyncData ({ app }) {
console.log(app.$env.TEST_VALUE)
}
}
// store/index.js
export const mutations = {
storeEnv (commit) {
const val = this.$env.TEST_VALUE
commit('testValue', val)
}
}
# Forlk the repo
git clone git@github.com:your_username/nuxt-env.git
cd nuxt-env
yarn
yarn test
# To use while developing other apps:
yarn link
cd ../my-other-app
yarn link nuxt-env
Bug reports and pull requests are welcome on GitHub at https://github.com/samtgarson/nuxt-env. This project is intended to be a safe, welcoming space for collaboration, and contributors are expected to adhere to the Contributor Covenant code of conduct.
The module is available as open source under the terms of the MIT License.
FAQs
Inject env vars for your Nuxt app at runtime
We found that nuxt-env demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.