registry / @dotenvx/dotenvx / 2.24.0
@dotenvx/dotenvx@2.24.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install hooks, and its flagged secret-like string is documentation for a user-supplied value. Update and Armor network behavior is command-triggered and consistent with the package’s purpose.
Static reason
One or more suspicious static signals were detected.
Trigger
A user runs an update or Armor command.
Impact
No automatic collection, credential theft, or unrelated system changes were identified.
Mechanism
The updater may run the published installer for a bundled executable; Armor commands check for updates or use the configured Armor service.
AI rationale
The package has no install hooks, and its flagged secret-like string is documentation for a user-supplied value. Update and Armor network behavior is command-triggered and consistent with the package’s purpose.
Network endpoints2
dotenvx.sh/VERSIONarmor.dotenvx.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest has no install lifecycle hooks; its scripts are for linting, tests, and releases.
- The private-key-looking string appears in CLI help as an example value for `dotenvx set`.
- The shell-based update runs only through the explicit `dotenvx update` command, and only for bundled executables.
- The version check is part of an explicit Armor command and fetches the package version endpoint.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/cli/help.jsView file
86patternName = private_key_openssh
severity = critical
line = 86
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8686patternName = private_key_openssh
severity = critical
line = 86
Critical
83$ dotenvx set KEY value
$ dotenvx set KEY "value with spaces"
$ dotenvx set KEY -- "---value with a dash---"
$ dotenvx set KEY -- "-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
Low
Ai Review Evidence
The private-key-looking string appears in CLI help as an example value for `dotenvx set`.
src/cli/help.jsView on unpkg · L83package.jsonView file
Findings
2 Critical1 High1 Medium8 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedpackage.json
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli/help.js
LowAi Review Evidencesrc/cli/dotenvx.js
LowAi Review Evidencesrc/cli/actions/update.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.24.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.24.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.