
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
start-envs
Advanced tools
主要优化多环境多项目环境,把配置文件与项目代码分离,方便维护管理,开发运行尽量简单直接。
pnpm i start-envs -D
在项目根目录运行
pnpm run start-envs
在项目根目录下新建配置文件,文件名为start-envs.config.json,
{
"configFolderName": "config",
"envFileName": "src/envs/config.js",
"script": ""
}
配置字段如下:
| 字段 | 类型 | 描述 |
|---|---|---|
| configFolderName | string | 配置文件夹名称,默认为config |
| envFileName | string | 生成的配置文件,默认为src/envs/config.js |
| script | string | 项目中package.json中的 scripts 命令,默认为空 |
项目配置文件是以yaml格式存储,文件名以.yaml结尾,文件名与环境名称一致,如:dev.yaml, test.yaml, prod.yaml,例如:
title: 项目名称 # 项目名称,必填
env: dev # 环境名称,如dev, uat, sit, prod,必填
name: project # 项目名称英文简称, 必填
description: 项目描述 # 项目描述
version: 1.0.0 # 项目版本
api: # 接口地址
baseUrl: http://localhost:8080
apiUrl: /api
apiPrefix: /api
apiVersion: v1
...
多个环境,在config目录下新增yaml文件即可。
在envFileName 中配置的配置文件,会生成在src/envs/config.js中,代码如下:
module.exports = {
"title": "项目名称",
"env": "dev",
"name": "project",
"description": "项目描述",
"version": "1.0.0",
"api": {
"baseUrl": "http://localhost:8080",
"apiUrl": "/api",
"apiPrefix": "/api",
"apiVersion": "v1"
}
}
支持命令行指定项目环境和运行命令
pnpm run start-envs name=project env=dev script=build
FAQs
We found that start-envs demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.