🔐 env-audit-log

A "CCTV Camera" for your application's environment variables.

env-audit-log is a lightweight, live runtime scanner that silently monitors every read access to process.env. It identifies exactly which library, plugin, or file is requesting your sensitive keys (like AWS_SECRET_KEY or DB_PASSWORD) and reports it upon process exit.

🚀 Why use this?

• Detect Malicious Packages: Spot 3rd-party dependencies trying to steal your secrets.
• Debug Configuration: See exactly where and when your app reads config.
• Zero Data Leakage: We NEVER log the value of the key. We only log the Key Name and the Caller File Path.

📦 Installation

npm install env-audit-log

🛠 Usage

You must initialize the logger at the very top of your application's entry file (e.g., index.ts, server.js, app.js).

// 1. Import at the very top
import { init } from 'env-audit-log';

// 2. Initialize immediately
init();

// ... your other imports and application code
import express from 'express';
// ...

How to Test

You can run the included demo to see it in action:

1. Clone this repo.
2. Run npm install
3. Run npm test

Or, simply add the init() call to your own app and stop it (Ctrl+C). You will see the report printed to the console.

📊 Sample Output

When your process exits (via exit, SIGINT, or SIGTERM), a report table is printed:

===============================================================
🔐  ENV AUDIT LOG - Process Exit Report
===============================================================
┌─────────┬──────────────────┬─────────────────────────────────────┬───────────┐
│ (index) │     Variable     │             Accessed By             │ Frequency │
├─────────┼──────────────────┼─────────────────────────────────────┼───────────┤
│    0    │ 'AWS_SECRET_KEY' │ '/Users/dev/app/src/evil-plugin.ts' │     1     │
│    1    │    'DB_HOST'     │   '/Users/dev/app/src/db/conn.ts'   │     4     │
│    2    │ 'STRIPE_API_KEY' │ '/Users/dev/app/src/billing.ts:40'  │     2     │
└─────────┴──────────────────┴─────────────────────────────────────┴───────────┘

🔒 Security Guarantee

• Live Runtime Scanning: This is not a static analysis tool. It uses a JavaScript Proxy to intercept actual reads in real-time as your code executes.
• Privacy First: The internal logic strictly logs the access event, but passes the value through without storing or printing it.

📄 License

ISC