5 ms·
dotenv has zero npm dependencies. dotenvx has 21, including a few I have never heard of. Is this really more secure?
by stiiv 2y ago
dotenv has zero npm dependencies. dotenvx has 21, including a few I have never heard of. Is this really more secure?
- deleted 2y ago[deleted]
- caliwagon 2y agoRecent versions of node support env files directly, so you don't even need one dependency anymore. https://nodejs.org/docs/latest-v20.x/api/cli.html#--env-fileconfig https://nodejs.org/docs/latest-v20.x/api/cli.html#--env-file...
- iamsaitam 2y agoThis is quite a common remark when it comes to Javascript. I rarely see the same being made about Rust libs, which also rely heavily on external dependencies.
- stiiv 2y agoJustifiably! Supply-chain attacks have occurred via npm, and have been widely reported. A lack of oversight and lack of standard libraries are often cited as the cause. I don't know if it's a problem for Rust (or other platforms like Python, .NET, or Java afaik). As someone who primarily writes TypeScript to run in browsers and on node.js, this kind of threat requires an extra level of vigilence, and often nudges me toward writing my own things rather than importing them.