Gathering detailed insights and metrics for dotenv-cra
Gathering detailed insights and metrics for dotenv-cra
Create React App style dotenv support for Node projects. Combine a base .env file with a .env.${NODE_ENV} file to create your optimum configuration.
Installations
npm install dotenv-craDeveloper Guide
BETA
Typescript
No
Module System
CommonJS
Min. Node Version
>=12
Node Version
16.19.0
NPM Version
7.21.1
Score
75.9
Supply Chain
99.4
Quality
75.9
Maintenance
100
Vulnerability
100
License
Releases
12
Languages
2
TypeScript
JavaScript
TypeScript (92.64%)
JavaScript (7.36%)
Developer
djdmbrwsk
Download Statistics
Total Downloads
767,745
Last Day
65
Last Week
3,585
Last Month
12,695
Last Year
171,060
GitHub Statistics
MIT License
9 Stars
187 Commits
1 Forks
2 Watchers
15 Branches
3 Contributors
Updated on Mar 25, 2025
Bundle Size
2.80 kB
Minified
1.37 kB
Minified + Gzipped
Maintainers
1
Package Meta Information
Latest Version
3.0.3
Package Id
dotenv-cra@3.0.3
Unpacked Size
9.78 kB
Size
4.04 kB
File Count
5
NPM Version
7.21.1
Node Version
16.19.0
Published on
Jan 20, 2023
Total Downloads
Cumulative downloads
Total Downloads
767,745
Last Day
124.1%
65
Compared to previous day
Last Week
20.6%
3,585
Compared to previous week
Last Month
-17.5%
12,695
Compared to previous month
Last Year
-19%
171,060
Compared to previous year
Weekly Downloads
Monthly Downloads
Yearly Downloads
Dependencies
2
Dev Dependencies
2
dotenv-cra
Create React App style dotenv support for
Node projects. Combine a base .env file with a .env.${NODE_ENV} file to
create your optimum configuration.
Note: It's not recommended that you store secrets (like private API keys) in
your .env file(s). Secret configuration values should be managed and provided
as part of your hosting solution.
Install
npm i dotenv-cra
Usage
Not much new here. As with dotenv, import/require dotenv-cra and configure it
as early as possible. This ensures that any modules reading values from
process.env can retrieve the expected values.
⚠️ Warning: The NODE_ENV variable must be set, so you may choose to default it
in your application before calling config().
1import { config } from 'dotenv-cra'; 2 3process.env.NODE_ENV = process.env.NODE_ENV || 'development'; 4config();
Note When using NodeJS v15 or higher you can use Logical Nullish Assignment as well:
1process.env.NODE_ENV ??= 'development';
At a minimum, create a base .env file in the root directory of your project
with KEY=value entires on each line. However, if that's all you ever do, you
don't need this library 😉. To see the real value of dotenv-cra, try creating a
second .env.development file with some new and some overlapping KEY=value
pairs.
# .env
LOG_LEVEL=info
PORT=3001
# .env.development
LOG_LEVEL=debug
# Loaded into process.env
LOG_LEVEL=debug
PORT=3001
What .env files can be used?
.env: Default..env.local: Local overrides. This file is loaded for all environments except test..env.development,.env.test,.env.production: Environment-specific settings..env.development.local,.env.test.local,.env.production.local: Local overrides of environment-specific settings.
Files on the left have more priority than files on the right:
npm start:.env.development.local,.env.local,.env.development,.envnpm test:.env.test.local,.env.test,.env(note.env.localis missing)
Options
Env
Default: process.env.NODE_ENV
You may specify a custom environment if you don't want to base the .env.*
files you load on NODE_ENV. For example, you may want NODE_ENV set to
production, but you want to load the .env.staging file.
1dotenvCra.config({ env: process.env.AWS_ENV });
Prefix
Default: none
You may specify a required prefix for your dotenv variables. For example, you
may want to prefix your variables with WEB_API_ to ensure there aren't any
collisions with other environment variables.
1dotenvCra.config({ prefix: 'WEB_API_' });
Path
Default: path.resolve(process.cwd(), '.env')
You may specify a custom path if your file containing environment variables is
located elsewhere. This will also be used as the basis for resolving the other
.env.* files.
1dotenvCra.config({ path: '/full/custom/path/to/your/.env' });
Encoding
Default: utf8
You may specify the encoding of your file containing environment variables. Passed through to dotenv.
1dotenvCra.config({ encoding: 'latin1' });
Debug
Default: false
You may turn on logging to help debug why certain keys or values are not being set as you expect. Passed through to dotenv.
1dotenvCra.config({ debug: process.env.DEBUG });
Credits
Thanks to these projects for this simple yet powerful approach 👏
No vulnerabilities found.
Reason
no binaries found in the repo
Reason
no dangerous workflow patterns detected
Reason
license file detected
Details
- Info: project has a license file: LICENSE:0
- Info: FSF or OSI recognized license: MIT License: LICENSE:0
Reason
dependency not pinned by hash detected -- score normalized to 6
Details
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:11: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:20: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:34: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:50: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: third-party GitHubAction not pinned by hash: .github/workflows/lint-build-test.yml:57: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/lint-build-test.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/release.yml/master?enable=pin
- Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/djdmbrwsk/dotenv-cra/release.yml/master?enable=pin
- Info: 0 out of 11 GitHub-owned GitHubAction dependencies pinned
- Info: 0 out of 1 third-party GitHubAction dependencies pinned
- Info: 5 out of 5 npmCommand dependencies pinned
Reason
Found 1/17 approved changesets -- score normalized to 0
Reason
0 commit(s) and 0 issue activity found in the last 90 days -- score normalized to 0
Reason
detected GitHub workflow tokens with excessive permissions
Details
- Warn: no topLevel permission defined: .github/workflows/lint-build-test.yml:1
- Warn: no topLevel permission defined: .github/workflows/release.yml:1
- Info: no jobLevel write permissions found
Reason
no effort to earn an OpenSSF best practices badge detected
Reason
security policy file not detected
Details
- Warn: no security policy file detected
- Warn: no security file to analyze
- Warn: no security file to analyze
- Warn: no security file to analyze
Reason
project is not fuzzed
Details
- Warn: no fuzzer integrations found
Reason
SAST tool is not run on all commits -- score normalized to 0
Details
- Warn: 0 commits out of 19 are checked with a SAST tool
Reason
32 existing vulnerabilities detected
Details
- Warn: Project is vulnerable to: GHSA-968p-4wvh-cqc8
- Warn: Project is vulnerable to: GHSA-67hx-6x53-jw92
- Warn: Project is vulnerable to: GHSA-h5c3-5r3r-rr8q
- Warn: Project is vulnerable to: GHSA-rmvr-2pp2-xj38
- Warn: Project is vulnerable to: GHSA-xx4v-prfh-6cgc
- Warn: Project is vulnerable to: GHSA-93q8-gq69-wqmw
- Warn: Project is vulnerable to: GHSA-grv7-fg5c-xmjg
- Warn: Project is vulnerable to: GHSA-3xgq-45jj-v275
- Warn: Project is vulnerable to: GHSA-pfrx-2q88-qq97
- Warn: Project is vulnerable to: GHSA-rc47-6667-2j5j
- Warn: Project is vulnerable to: GHSA-78xj-cgh5-2h22
- Warn: Project is vulnerable to: GHSA-2p57-rm9w-gvfp
- Warn: Project is vulnerable to: GHSA-896r-f27r-55mw
- Warn: Project is vulnerable to: GHSA-9c47-m6qq-7p4h
- Warn: Project is vulnerable to: GHSA-5v2h-r2cx-5xgj
- Warn: Project is vulnerable to: GHSA-rrrm-qjm4-v8hf
- Warn: Project is vulnerable to: GHSA-952p-6rrq-rcjv
- Warn: Project is vulnerable to: GHSA-f8q6-p94x-37v3
- Warn: Project is vulnerable to: GHSA-xvch-5gv4-984h
- Warn: Project is vulnerable to: GHSA-r683-j2x4-v87g
- Warn: Project is vulnerable to: GHSA-hj9c-8jmm-8c52
- Warn: Project is vulnerable to: GHSA-hrpp-h998-j3pp
- Warn: Project is vulnerable to: GHSA-p8p7-x288-28g6
- Warn: Project is vulnerable to: GHSA-x2pg-mjhr-2m5x
- Warn: Project is vulnerable to: GHSA-c2qf-rxjj-qqgw
- Warn: Project is vulnerable to: GHSA-44c6-4v22-4mhx
- Warn: Project is vulnerable to: GHSA-4x5v-gmq8-25ch
- Warn: Project is vulnerable to: GHSA-f5x3-32g6-xq36
- Warn: Project is vulnerable to: GHSA-72xf-g2v4-qvf3
- Warn: Project is vulnerable to: GHSA-38fc-wpqx-33j7
- Warn: Project is vulnerable to: GHSA-j8xg-fqg3-53r7
- Warn: Project is vulnerable to: GHSA-3h5v-q93c-6h6q
Score
3.2
/10
Last Scanned on 2025-05-12
The Open Source Security Foundation is a cross-industry collaboration to improve the security of open source software (OSS). The Scorecard provides security health metrics for open source projects.
Learn More