# npm-vulnerable-env-check

> Checks how open your npm install execution environment is

Latest version **1.1.1** (published 2017-04-28) · ISC license · 9 weekly downloads

## Install

```sh
npm install npm-vulnerable-env-check
pnpm add npm-vulnerable-env-check
yarn add npm-vulnerable-env-check
bun add npm-vulnerable-env-check
```

## Health

**Score 5/100 (F)** — status: abandoned.

Positive: no vulnerabilities.

Warnings: low downloads; no types; no esm support.

Negative: abandoned; low maintenance score; declining downloads.

## Facts

| | |
|---|---|
| Version | 1.1.1 |
| Published | 2017-04-28 |
| First published | 2017-04-28 |
| Weekly downloads | 9 |
| License | ISC |
| TypeScript types | none |
| Module format | CommonJS |
| Dependencies | 0 |
| Known vulnerabilities | 0 |
| Install scripts | yes |
| Author | Ben Gummer |
| Maintainers | bengummer |

## Links

- npm: https://www.npmjs.com/package/npm-vulnerable-env-check
- npm.io page: https://npm.io/package/npm-vulnerable-env-check

## Recent versions

- 1.1.1 (latest) — 2017-04-28
- 1.1.0 — 2017-04-28
- 1.0.2 — 2017-04-28
- 1.0.1 — 2017-04-28
- 1.0.0 — 2017-04-28
- 0.0.4 — 2017-04-28
- 0.0.3 — 2017-04-28
- 0.0.2 — 2017-04-28

## README

# npm-vulnerable-env-check

🤠 **Warning:** this package logs the names of your environment variables locally. Only use if you're ok with that.

## Introduction

The modularity of the npm ecosystem is great, but it means that often when you install a harmless looking package, that package could itself depend on a harmful package that is out of your control. This is made worse by the fact that scripts like `preinstall` are executed automatically.

At best you end up with a large bitmap image of [Guy Fieri](https://medium.com/friendship-dot-js/i-peeked-into-my-node-modules-directory-and-you-wont-believe-what-happened-next-b89f63d21558) in your `node_modules` directory. At worst your execution environment may be compromised, with env variable values exposed and arbitrary scripts executed.

## Checking your environment

Just install the package via npm...

```bash
npm install npm-vulnerable-env-check
```

```
Found 15 secure env vars containing 'key' or 'token':
S3_KEY_PREFIX
BROWSERSTACK_KEY
GOOGLE_API_KEY
AWS_ACCESS_KEY
AWS_SECRET_ACCESS_TOKEN
...

Found 187 other env vars:
npm_config_save_dev
npm_config_legacy_bundling
npm_config_dry_run
npm_package_dependencies_request
```

And then check the log output in your CLI.

## Developing locally

```bash
git clone https://github.com/bengummer/npm-vulnerable-env-check.git
cd npm-vulnerable-env-check
yarn
```

---
_Source: https://npm.io/package/npm-vulnerable-env-check · Machine-readable twin of the npm.io package page. Health data is recomputed on every publish._