
Research
/Security News
9 Malicious NuGet Packages Deliver Time-Delayed Destructive Payloads
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.
command line interface for quickly switching .env file from Keepass entries (content from the Notes field)
Command line tool to quickly switch .env file from Keepass entries (content from the Notes field)

yarn add -D switchenv
or
npm install -D switchenv
You need to go through a one time setup per project. That will take you a few minutes. Afterwards you'll be able to run this command to change your .env file.
yarn switchenv development
or
npm run switchenv development
It will read and decrypt the keepass file and look for an entry with the title: development. The Notes of that entry will overwrite the .env file.
Nota Bene: It will overwrite the .env file without warning!
You need to do this setup once per project.
package.json resides.NB: Your keepass and key file should never be committed!
package.json file add a switchenv command in the scripts section.{
...
"scripts": {
"switchenv": "node ./node_modules/switchenv --source /envs/keepass.kdbx --key /envs/keyfile"
},
...
}
In this example
--source /envs/keepass.kdbx is the path to the keepass file.--key /envs/keyfile is the path to the key file.--target /config.js if you want to write to something else than /.env--title .env-{title}-backend if you have longer entry titles like .env-development-backend instead of just development. In this case, you can still run yarn switchenv developmentFAQs
command line interface for quickly switching .env file from Keepass entries (content from the Notes field)
We found that switchenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
/Security News
Socket researchers discovered nine malicious NuGet packages that use time-delayed payloads to crash applications and corrupt industrial control systems.

Security News
Socket CTO Ahmad Nassri discusses why supply chain attacks now target developer machines and what AI means for the future of enterprise security.

Security News
Learn the essential steps every developer should take to stay secure on npm and reduce exposure to supply chain attacks.