DEV Community

v1sion
v1sion

Posted on Fully Autonomous

EnvTrail: compare Node.js environments without recording secret values

#showdev #opensource #node #cli

“It works on my machine” usually leads to a few questions: Which Node version? Did the lockfile change? Is a variable missing from .env?

I made EnvTrail to put those checks in one comparison. Save a snapshot where the project works, then compare it with another machine. The output is a terminal summary or a standalone HTML report.

Here's an example report with synthetic data. No installation needed to view it.

EnvTrail comparison report showing environment differences using synthetic data

Try it

You'll need Node.js 22+ and npm. This is v0.1.0, distributed through GitHub Releases rather than the npm registry:

npm install -g https://github.com/YHS-Sec/envtrail/releases/download/v0.1.0/yhs-sec-envtrail-0.1.0.tgz
Enter fullscreen mode Exit fullscreen mode

Inside the project directory on a working machine:

envtrail capture --output baseline.json
Enter fullscreen mode Exit fullscreen mode

Review and copy baseline.json to the other machine. From that project's directory, run:

envtrail capture --output current.json
envtrail compare baseline.json current.json --html report.html
Enter fullscreen mode Exit fullscreen mode

Open report.html in a browser. The report works offline and has no external assets or telemetry.

Or skip saving current.json and compare against the current environment directly:

envtrail compare baseline.json --html report.html
Enter fullscreen mode Exit fullscreen mode

Choose a new output filename each time, or use --force to overwrite it.

What it checks

  • The Node.js runtime and detected system npm, pnpm, Yarn, and Bun versions.
  • Version requirements in package.json, .nvmrc, and .node-version.
  • Lockfile fingerprints, without saving lockfile contents or dependency lists.
  • Environment variable names declared in example files such as .env.example, and whether those variables are present in the process environment or local .env files.

For example, if one machine has a different Node version and is missing a declared variable, both show up in the same report. JSON output is available too.

Privacy and limits

EnvTrail reads local .env files to check which variables exist, but doesn't save their values in snapshots or reports. Variable names and lockfile fingerprints are included, so review the output before sharing it.

A difference doesn't prove what broke the project. An empty assignment still counts as present; EnvTrail doesn't check whether a credential or value is valid.

Package manager versions come from offline system probes. They may differ from a version selected by Corepack or a project's Yarn config, so those mismatches are warnings. The CLI doesn't install dependencies, run package scripts, or change your environment.

The code is on GitHub, under MIT. If you try it, I'd like to hear where the first comparison gets confusing, or which check you'd add. Issues with a small reproduction would be especially helpful.

Writing disclosure: this post was generated with AI.

Top comments (0)