
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
properties-gen
Advanced tools
CLI that generates properties files for a given environment.
You need to build your application for different targets, so you have a base configuration file with default values and want to override specific ones for the rest of the targets.
This way you dont need to define every dynamic value by using environment variables.
Locally in your project.
$ npm install -D properties-gen
or globally
$ npm install -g properties-gen
Install with yarn
$ yarn i properties-gen --save-dev
Usage: properties-gen [options] [command]
Options:
-h, --help display help for command
Commands:
init Generates default config file
generate [options] Generates environment properties files
help [command] display help for command
Options for generate command:
Usage: properties-gen generate [options]
Generates environment properties files
Options:
-f, --file [pathToFile] Specify configuration file
-h, --help display help for command
Generate the initial configuration file
$ npx properties-gen init
This will create a properties.config.json file in your root directory, notice you can define as many properties files as you need (groups in the configurationGroups array), usually we just need client, server or both.
{
"configurationGroups": [
{
"inputFolder": "config/server/",
"inputFileNamePattern": "env.{{envTargetKey}}.json",
"outputFile": "environment/env.server.js",
"extendsFromBase": true,
"fileBaseName": "base.json"
},
{
"inputFolder": "config/client/",
"inputFileNamePattern": "env.{{envTargetKey}}.json",
"outputFile": "environment/env.client.js",
"extendsFromBase": true,
"fileBaseName": "base.json"
}
],
"envTargetKey": "NODE_ENV",
"useEsModule": true,
"defaultEnvTargetValue": "dev"
}
| name | type | description |
|---|---|---|
| envTargetKey | {String} | default: NODE_ENV Environment variable key which dictates the environment file to process. (e.g.) COUNTRY, TENANT |
| defaultEnvTargetValue | {String} | default: dev Fallback value for envTargetKey key. (e.g. NODE_ENV=dev) |
| useEsModule | {Boolean} | default: true When true, the output file will be an ES module, otherwise it will be a CommonJS module. |
| configurationGroups | Array of {configurationGroup} | |
| configurationGroup.inputFolder | {String} | default: config/server/ Folder where configuration files are located |
| configurationGroup.inputFileNamePattern | {String} | default: env.{{envTargetKey}}.json The name pattern for the input files, notice you must include {{envTargetKey}} in order to dynamically pick the right one when running the generate command. |
| configurationGroup.outputFile | {String} | default: environment/env.groupName.js The output filename, only .json or .js extensions are valid. |
| configurationGroup.extendsFromBase | {Boolean} | default: true When active will look for a base.json file in the configurationGroup.inputFolder location in order to extend the configuration values. |
| configurationGroup.fileBaseName | {String} | default: base.json The base configuration file name to pick when configurationGroup.extendsFromBase is true, only .json or .js extensions are valid. |
For each configuration group, create the folder that contains the base.json (if extendsFromBase is true) and as many env.{ENV}.json files as you need, for example:
config/server/base.json
{
"isProduction": false,
"someKey": "someValue",
"msHost": "http://localhost:3010/",
"db": {
"someSecret": "{{SECRET}}"
}
}
Overrite and extend values for the rest of environments.
config/server/env.dev.json
{
"msHost": "http://api.dev.myapp.com"
}
config/server/env.prod.json
{
"isProduction": true,
"msHost": "https://api.myapp.com/"
}
npx properties-gen generate
This command will take the current environment to generate the properties file in the location defined on outputFile. Notice NODE_ENV is the default key for the environments but you can override this value by setting a different one in envTargetKey like COUNTRY or TENANT.
Example:
NODE_ENV=prod SECRET=mySecret npx properties-gen generate
output: environment/env.server.js
module.exports = {
isProduction: true,
someKey: 'someValue',
msHost: 'https://api.myapp.com/',
db: {
someSecret: 'mySecret',
},
}
Tip: use npx properties-gen init to create the configuration file, then install properties-gen as a development dependency in your project and finally chain the properties-gen generate command before the start|dev|build command, so properties are generated before running the project.
Tip: you may want to add the output file to .gitignore as is not meant to be tracked
Package script example using NextJs
package.json
{
"name": "myApp",
"scripts": {
"config": "properties-gen generate",
"dev": "npm run config && next dev",
"build": "npm run config && next build",
"start": "next start"
}
}
FAQs
CLI to generate environment properties based on config
We found that properties-gen demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.