registry / @dotenvx/dotenvx / 2.33.0
@dotenvx/dotenvx@2.33.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install lifecycle scripts, and the flagged 1Password code is part of an explicit local key-custody feature. The apparent secret in help output is a truncated command example, not a credential used by package code.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
No install or import-time action identified. Custody transfers require a user-run CLI command; update checks run from selected CLI commands.
Impact
No unauthorized data collection or account action identified.
Mechanism
The 1Password integration uses the user's signed-in op CLI to store or read dotenvx keys. The update check requests a version string from dotenvx.sh.
AI rationale
The package has no install lifecycle scripts, and the flagged 1Password code is part of an explicit local key-custody feature. The apparent secret in help output is a truncated command example, not a credential used by package code.
Evidence
.env.keys
Network endpoints1
dotenvx.sh
Decision evidence
public snapshotAI called this Clean at 98.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install, preinstall, or postinstall lifecycle scripts.
- The private-key-looking string in src/cli/help.js appears in a dotenvx set command example and is visibly truncated, not an active credential.
- Password-manager storage is offered through an explicit storage selection; noninteractive use defaults to native storage or files.
- The 1Password integration uses the signed-in account and stores the key as a concealed 1Password field when the user runs a custody operation.
- The update check fetches a version string from dotenvx.sh and stores it locally.
Evidence against
Behavioral surface
ChildProcessCryptoEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
86$ dotenvx set KEY -- "---value with a dash---"
$ dotenvx set KEY -- "-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
Low
Ai Review Evidence
The private-key-looking string in src/cli/help.js appears in a dotenvx set command example and is visibly truncated, not an active credential.
src/cli/help.jsView on unpkg · L86src/lib/helpers/ptyCommand.js#virtual:normalized:round1
Findings
2 Critical2 High1 Medium7 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/lib/custodians/local/onepassword.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli/help.js
LowAi Review Evidencesrc/lib/helpers/selectKeyStorage.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.33.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.33.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.