
Security News
Axios Maintainer Confirms Social Engineering Attack Behind npm Compromise
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.
read-env-file
Advanced tools
Utilities for reading environment variable names & values from files in ".env" format
Utilities for reading environment variable names & values from files in ".env" format
✔ Reads key/value pairs
✔ Handles commented & empty lines
✔ Allows spaces in quoted values
✔ Allows assignment operators in quoted values
✔ Reads from "./.env" when no path arg supplied
✔ Merges the results of multiple input files
✔ Invalid Format (missing key)
✔ Invalid Format (missing value)
✔ Invalid Format (missing assignment)
✔ Invalid Format (space in key)
✔ Invalid Format (space in unquoted value)
✔ Invalid Format (multiple assignment operators)
✔ Invalid Format Error contains accurate line number
yarn add read-env-file
# or
npm i read-env-file
Typescript-friendly (type declarations included)
# path/to/.env
key1=foo
key2=bar
# path/.env
key1=foobar
key3=baz
// path/to/dir/index.js
const { readSingle, readMultiple } = require('read-env-file');
readSingle(); // Attempts to read from ./.env
readSingle('path/to/.env');
// Promise<{key1: 'foo', key2: 'bar'}>
readSingle.sync('path/to/.env');
// {key1: 'foo', key2: 'bar'}
readMultiple(['path/to/.env', 'path/.env']);
// Promise<{key1: 'foobar', key2: 'bar', key3: 'baz'}>
readMultiple.sync(['path/to/.env', 'path/.env']);
// {key1: 'foobar', key2: 'bar', key3: 'baz'}
', ", or backtick) to include spaces and = characterExamples:
key=value
# comment starts with "#" (ignored)
# whitespace is trimmed from keys and values
key = value
key =value
key= value
# whitespace in quoted values preserved
key="value with spaces'
# Assignment operators in quoted values preserved
key="value=abc"
Errors are informative and specify the cause, file, and line number:
Invalid file format (multiple assignment operators) at /some/path/.env:12
The following conditions cause an invalid format error:
| Cause | Error Mssage |
|---|---|
| missing key | key undefined |
| missing value | value undefined |
| missing assignment | value undefined |
| space in key | invalid spacing |
| space in unquoted value | invalid spacing |
| multiple assignment operators | multiple assignment operators |
Examples:
# missing key
=value
# missing value
key=
# missing assignment
keyvalue
# space in key
k e y = value
# space in unquoted value
key=value and words
# multiple assignment operators
key=value=invalid
None
FAQs
Utilities for reading environment variable names & values from files in ".env" format
We found that read-env-file demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.

Security News
The Axios compromise shows how time-dependent dependency resolution makes exposure harder to detect and contain.