
Research
Supply Chain Attack on Axios Pulls Malicious Dependency from npm
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.
Gone are the days of flat .env files. This allows to you dynamically build your env.
A runnable env environment
Gone are the days of using flat .env files. This module will help you to build your env should you need that flexability.
Here is a simple example:
// .env.js
// Set your own defaults, whatever! Its your env anyways!
const env = {
NODE_ENV: 'develop'
}
// Dynamically change thigns...
if (env.NODE_ENV === 'develop') {
env.LOGGING = true
}
// Put all your vars into the exports!
module.exports = env
And you can now just use it as expected:
require('jsdotenv').config()
if (process.env.LOGGING) {
console.log('Look Mom no hands!')
}
You can simply install:
npm i --save jsdotenv
And then create a .env.js file in your root. After that include this package like you see above and you are ready to go!
You can access this simple package with a simplified example, or use some of our additional Features.
If you just wanna parse a file, try the following:
const jsdotenv = require('jsdotenv')
const parsed = jsdotenv.parse('/path/to/some/file.js')
console.log(parsed) // will be the evaluated parsed result.
The example above is the minimalistic approach of the config function. You can also use advanced features as well like so (defaults in parenthesis):
require('jsdotenv').config({
path: '.env.js' // The .env file to evaluate.
})
MIT
FAQs
Gone are the days of flat .env files. This allows to you dynamically build your env.
The npm package jsdotenv receives a total of 3 weekly downloads. As such, jsdotenv popularity was classified as not popular.
We found that jsdotenv demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
A supply chain attack on Axios introduced a malicious dependency, plain-crypto-js@4.2.1, published minutes earlier and absent from the project’s GitHub releases.

Research
Malicious versions of the Telnyx Python SDK on PyPI delivered credential-stealing malware via a multi-stage supply chain attack.

Security News
TeamPCP is partnering with ransomware group Vect to turn open source supply chain attacks on tools like Trivy and LiteLLM into large-scale ransomware operations.