check-env icon indicating copy to clipboard operation
check-env copied to clipboard

Remove cowsay from production dependencies

Open joeljuca opened this issue 7 years ago • 0 comments

Hello @ekmartin!

I stumbled upon your project while looking for a package to turn environment variables required. Neat project! The only issue I found on it was the presence of a production dependency which check-env's main functionality does not depend on.

From a security point of view, the addition of check-env as a dependency into a Node.js project means introducing a whole dependency tree described in cowsay's package.json. Since reducing attack surfaces became a serious concern in Node.js projects, I think it would be wise to remove cowsay from check-env, thus making it a safer piece of software.

FYI, I'm working on a patch for you. Expect a pull request to be submitted in the upcoming hours.

joeljuca avatar Mar 20 '19 00:03 joeljuca