@dotenvx/dotenvx@2.29.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe flagged 1Password source stores keys through the local 1Password CLI and persists only a reference; the proxy requires placeholder credentials and an Armor login, then forwards to a configured Armor host. Package metadata shows no install lifecycle hook, and Git protections are installed through the explicit protect command.
Decision evidence
public snapshot- The package exposes a CLI and library; package.json shows no install lifecycle hook.
- The 1Password integration saves the private key through the local 1Password CLI and stores a local reference.
- The credential proxy activates only when configured placeholders are present and an Armor token is available.
- The proxy limits forwarding to configured credential hosts over HTTPS and sends requests to the session-configured Armor hostname.
- The new protect command installs Git protections when explicitly run.
Source & flagged code
6 flaggedPackage contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L87A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.29.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.29.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.