check-env
check-env copied to clipboard
Remove cowsay from production dependencies
Hello @ekmartin!
I stumbled upon your project while looking for a package to turn environment variables required. Neat project! The only issue I found on it was the presence of a production dependency which check-env's main functionality does not depend on.
From a security point of view, the addition of check-env as a dependency into a Node.js project means introducing a whole dependency tree described in cowsay's package.json. Since reducing attack surfaces became a serious concern in Node.js projects, I think it would be wise to remove cowsay from check-env, thus making it a safer piece of software.
FYI, I'm working on a patch for you. Expect a pull request to be submitted in the upcoming hours.