
Security News
AI Agent Lands PRs in Major OSS Projects, Targets Maintainers via Cold Outreach
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.
A bit like foreman, uses dotenv and comes from the create-react-app environment loader code.
npm install --save renvy
Important: renvy will default to NODE_ENV=development if there is no value on NODE_ENV.
// populates process.env
require('renvy'); // do this as early as possible in the code
// Also populate and return
const { raw, stringified } = require('renvy');
Files on the left have more priority than files on the right:
renvy: .env.development.local, .env.development, .env.local, .envNODE_ENV=production renvy: .env.production.local, .env.production, .env.local, .envnpm test: .env.test.local, .env.test, .env (note .env.local is missing).env: Default..env.local: Local overrides. This file is loaded for all environments except test..env.development, .env.test, .env.production: Environment-specific settings..env.development.local, .env.test.local, .env.production.local: Local overrides of environment-specific settings.Files on the left have more priority than files on the right:
npm start: .env.development.local, .env.development, .env.local, .envnpm run build: .env.production.local, .env.production, .env.local, .envnpm test: .env.test.local, .env.test, .env (note .env.local is missing)These variables will act as the defaults if the machine does not explicitly set them.
Please refer to the dotenv documentation for more details.
Note: If you are defining environment variables for development, your CI and/or hosting platform will most likely need these defined as well. Consult their documentation how to do this. For example, see the documentation for Travis CI or Heroku.
$VAR by default (via dotenv-expand). Important escaped \$ does not work, and is expanded to undefined. To disable env expansion, set environment value NO_EXPAND=true..env.example if the file is found in the current working directory (very similar to dotenv-safe - but merges environment values first, then checks)Beyond using the package as a dependency, a CLI utility is provided for testing environment values and also injecting the environment variables into a command.
Assuming the package was installed locally to your project, and using npx to run a .bin command:
$ NODE_ENV=test npx renvy
> # prints entire environment loaded
$ NODE_ENV=test npx renvy NODE_ENV
> test
$ NODE_ENV=test npx renvy -- node -e "console.log(process.env.NODE_ENV)"
> test
-- Double dash to signify the end of the optionsWhen passing -- to renvy everything afterwards will be executed with the modified environment (a bit like the foreman command line too).
renvy is weird, but it comes from it previously being called @remy/envy and since the envy namespace was gone and people feel weird about installed scoped dependencies when they belong to individuals, I slapped my first initial on the name, thus: renvy.
FAQs
A sensible and controllable env file loader.
We found that renvy demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
An AI agent is merging PRs into major OSS projects and cold-emailing maintainers to drum up more work.

Research
/Security News
Chrome extension CL Suite by @CLMasters neutralizes 2FA for Facebook and Meta Business accounts while exfiltrating Business Manager contact and analytics data.

Security News
After Matplotlib rejected an AI-written PR, the agent fired back with a blog post, igniting debate over AI contributions and maintainer burden.