Secure-env is a module that loads environment variables from a .env.enc
file.A encryption tool that would helps you prevent attacks from npm-malicious-packages.
$ npm install secure-env
Create a .env
file somewhere in your project. Add
environment-specific variables on new lines in the form of NAME=VALUE
.
For example:
KEY=VALUE
NUMBER=2 #numbers are parsed as strings
$ npm install -g secure-env
$ secure-env .env -s mySecretPassword
Alternatively if you want this installed locally run the command as follows:
$ ./node_modules/secure-env/dist/es5/lib/cli.js .env -s mySecretPassword -o .env.enc
If you are running NPM > v5.2. You can use npx
:
$ npx secure-env .env -s mySecretPassword -o .env.enc
A new encrypted file .env.enc
will be created in your project root directory. You can delete the .env
file now
As early as possible in your application, require and configure dotenv.
let secureEnv = require('secure-env');
const envObject = secureEnv({secret:'mySecretPassword', encryptedFile: 'pathToEncryptedFile' });
envObject
now has all the parsed variables assigned as keys and values.
🚨This procedure can completely undo the entire security of this module. Make sure you do not commit the decrypted file!🚨️
npx secure-env -d -e "encryptedFilePath"
$ secure-env --option <VALUE> <file-path-which-is-to-be-encrypted>
Option | What does it do | Defaults |
---|---|---|
--secret | Specify the secret Key which would be later used to decrypt the file. | mySecret |
--encryptedFile | The encrypted file path that would be created. | env.enc |
--algo | The encryption algorithm that is to be used to encrypt the env file. | aes256 |
--decrypt | prints the decrypted text to stdout |
Default: .env
You can specify a custom path if your file containing environment variables is named or located differently.
require('secure-env')({path:'/custom/path/to/your/env/vars'});
Default: aes256
You may specify the encryption algorithm for your file containing environment variables using this option.
require('secure-env')({enc_algo:'aes256'});
Default: mySecret
Specify the secret Key which was used during encryption of raw file.Having a salt-hashed secret key is recommended.
require('secure-env')({secret:'mySecretPassword'});
Refer https://github.com/motdotla/dotenv/blob/master/README.md#parse
The parsing engine currently supports the following rules:
-
BASIC=basic
becomes{BASIC: 'basic'}
- empty lines are skipped
- lines beginning with
#
are treated as comments - empty values become empty strings (
EMPTY=
becomes{EMPTY: ''}
) - single and double quoted values are escaped (
SINGLE_QUOTE='quoted'
becomes{SINGLE_QUOTE: "quoted"}
) - new lines are expanded if in double quotes (
MULTILINE="new\nline"
becomes
{MULTILINE: 'new
line'}
- inner quotes are maintained (think JSON) (
JSON={"foo": "bar"}
becomes{JSON:"{\"foo\": \"bar\"}"
) - whitespace is removed from both ends of the value (see more on
trim
) (FOO=" some value "
becomes{FOO: 'some value'}
) G.md)
See LICENSE
Source-env uses these open source projects to work properly:
- Minimist - Argument parser without all the fanciful decoration.
Source-env-async is stolen directly from secure-env to fix bugs and add features i wanted
it apparently also takes inspiration from: