registry / @dotenvx/dotenvx / 2.28.0
@dotenvx/dotenvx@2.28.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged key-like string is a truncated SSH-key example in CLI help. The new 1Password helper stores and retrieves dotenvx keys through the user’s 1Password account, while the proxy requires configured placeholder credentials and Armor authentication; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
The CLI or library is used; 1Password access requires configured storage or interactive selection, and proxying requires active placeholders and Armor authentication.
Impact
No unauthorized collection, unrelated credential forwarding, or unrequested account action was identified.
Mechanism
Private keys are stored and retrieved through the selected 1Password account. The proxy forwards matching requests to the configured Armor service and is applied to a user-launched command.
AI rationale
The flagged key-like string is a truncated SSH-key example in CLI help. The new 1Password helper stores and retrieves dotenvx keys through the user’s 1Password account, while the proxy requires configured placeholder credentials and Armor authentication; no malicious behavior was identified.
Evidence
OS temporary directory: dxp-* (proxy CA and preload files)
Network endpoints1
<configured Armor hostname>/api/proxy
Decision evidence
public snapshotAI called this Clean at 97.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a dotenv library and CLI; its manifest declares no install lifecycle scripts.
- The 1Password feature stores the private key in the user’s signed-in 1Password account and keeps a locator locally; account discovery runs only for interactive storage selection.
- The credential proxy starts only for active placeholder credentials and requires an Armor login token.
- The proxy sends requests containing matching credential placeholders to the configured Armor host, for the requested destination and operation.
- The help example’s SSH key-like string is truncated example data, not a usable private key.
Evidence against
- The CLI includes an update command that invokes a shell installer when explicitly run from a packaged binary.
- The proxy creates temporary certificate files and configures the launched command to use a local proxy; these are part of the credential-proxy feature.
Behavioral surface
ChildProcessCryptoDynamicRequireEnvironmentVarsFilesystem
Source & flagged code
6 flaggedsrc/cli/help.jsView file
86patternName = private_key_openssh
severity = critical
line = 86
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8686patternName = private_key_openssh
severity = critical
line = 86
Critical
src/shared/logger.jsView file
1const Errors = require('../lib/helpers/errors')
L2: const { getColor, bold } = require('./colors')
Medium
Dynamic Require
Package source references dynamic require/import behavior.
src/shared/logger.jsView on unpkg · L1Findings
2 Critical2 High3 Medium5 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedpackage.json
HighPrevious Version Dangerous Deltasrc/lib/helpers/onePasswordCustody.js
MediumDynamic Requiresrc/shared/logger.js
MediumNetwork
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.28.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.28.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.