Introduction

envtrap v2.1 — Runtime security for Node.js. Block secret exfiltration before it leaves your process.

What is envtrap?

envtrap is an open-source runtime security tool for Node.js applications. It wraps your process and intercepts every outbound channel in real time — before secrets, credentials, or sensitive environment variables can be exfiltrated by malicious code, compromised packages, or insider threats.

Unlike static analysis tools (SAST) that scan source code at build time, envtrap operates at execution time inside the Node.js runtime — inspecting actual traffic, child processes, DNS queries, and stdout/stderr output as they happen.

The Problem

Modern Node.js applications are rich with sensitive data:

• STRIPE_SECRET_KEY, DATABASE_URL, OPENAI_API_KEY …
• Thousands of transitive npm dependencies with supply-chain risk
• No runtime visibility into what leaves your process

A single compromised package — even a deep transitive dependency — can silently exfiltrate your secrets. Traditional security tools won’t catch this because:

Tool	What it does	What it misses
SAST / linting	Scans source code for patterns	Runtime behavior, dynamic secrets
Secrets scanners	Finds secrets committed to git	Secrets only present at runtime
WAFs / Firewalls	Filters inbound traffic	Outbound, process-level egress
EDR / AV	Detects known malware	Legitimate runtime exfiltration

The Solution

envtrap solves this by wrapping your Node.js process with a zero-instrumentation runtime guard that:

• 🔒 Intercepts HTTPS / HTTP outbound requests via an in-memory MITM proxy
• 🔒 Monitors stdout / stderr for secret patterns and redacts them
• 🔒 Blocks unauthorized child processes and execSync calls
• 🔒 Detects DNS tunneling exfiltration attempts
• 🔒 Synchronizes dynamically-rotated runtime secrets in real time
• 🔒 Automatically bypasses local loopback traffic from the proxy

# Before: vulnerable
node app.js

# After: protected
envtrap run node app.js

That’s it. No code changes. No SDK to install. No agent to manage.

Key Features

Zero Instrumentation

Drop envtrap in front of any node command. Works with Express, NestJS, Next.js, Fastify, and bare scripts.

HTTPS Interception

Native OpenSSL RSA — certificates generated in ~5ms. Loopback traffic bypassed automatically via NO_PROXY.

Entropy Detection

Shannon entropy analysis catches high-entropy credential strings including dynamically-rotated secrets.

DNS Tunneling Guard

Detect and block DNS-based exfiltration via encoded subdomains, covering both callback and promise APIs.

Real-Time Sync

process.env Proxy + MessageChannel broadcasts secret rotations to the ESM loader thread instantly.

Configurable Policy

Fine-tune block vs warn per channel via envtrap.json. Path exclusions and domain allowlists supported.

What’s New in v2.1.0

Native RSA Key Generation

TLS certificate synthesis reduced from ~200ms to ~5ms using Node’s crypto.generateKeyPairSync (C++ OpenSSL).

O(n) Chunk Scanner

Eliminated O(n²) Buffer.concat in the MITM proxy — now uses a sliding-window overlap scanner.

Shell Injection Prevention

All system CA tooling migrated from execSync template strings to safe execFileSync argument arrays.

RFC 5280 Cert Serials

Certificate serial numbers now use crypto.randomBytes(20) — no more Date.now() collision risk.

Live Secrets Sync

Runtime process.env mutations are broadcast to the ESM loader thread via MessageChannel immediately.

Automatic NO_PROXY

Loopback addresses and exclusions.domains are automatically added to NO_PROXY/no_proxy.

Next Steps

Quickstart

Get envtrap running in under 60 seconds.

How It Works

Deep dive into the runtime interception architecture.

Configuration

Customize channels, exclusions, and policies.

CLI Reference

Full reference for the envtrap CLI.