How can Node.js protect process.env from being read by 3rd party npm packages?

Question

System administration

Very often, all sorts of settings, such as connecting to databases, are passed as environment variables. But any third party script can read process.env . How to protect yourself from this?

Answer 1

Run the application under it by the created user, making the config file available only to this user.

Answer 2

At the beginning of index.js (before the first require) copy process.env and replace it with an empty object)

Answer 3

Don't pass data through environment

Answer 4

To the fullest - none