registry / @dotenvx/dotenvx / 2.34.1
@dotenvx/dotenvx@2.34.1
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe scanner’s secret match is an illustrative help example, and the 1Password code handles keys through explicit custody commands. The inspected update request fetches only the package version from its own host; no malicious behavior was identified.
Static reason
One or more suspicious static signals were detected.; previous stored version diff introduced dangerous source
Trigger
Library import exposes functions; network checks and custody operations run through CLI commands.
Impact
No unauthorized data collection, credential exfiltration, or destructive behavior was identified.
Mechanism
The update check retrieves a version from dotenvx.sh. Explicit custody commands use the selected provider to store or retrieve keys.
AI rationale
The scanner’s secret match is an illustrative help example, and the 1Password code handles keys through explicit custody commands. The inspected update request fetches only the package version from its own host; no malicious behavior was identified.
Network endpoints1
dotenvx.sh/VERSION
Decision evidence
public snapshotAI called this Clean at 96.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The package exposes a library entry point and CLI; its scripts are development and release checks, with no install lifecycle hook.
- The SSH private key pattern appears in CLI help as an example value for the `set` command.
- The 1Password integration stores a private key only through the explicit custody transfer action, which uses the 1Password CLI.
- The update checker fetches a version string from dotenvx.sh and is called by CLI management commands.
- The library entry point exports functions without invoking them at module top level.
Evidence against
- The package includes shell-download commands for explicit update or setup workflows; these are not install hooks.
- The 1Password provider handles secrets, but the inspected flow sends them to the user’s selected 1Password account. No unrelated credential collection or transmission was identified.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
84$ dotenvx set KEY value
$ dotenvx set KEY "value with spaces"
$ dotenvx set KEY -- "---value with a dash---"
$ dotenvx set KEY -- "-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
Low
Ai Review Evidence
The SSH private key pattern appears in CLI help as an example value for the `set` command.
src/cli/help.jsView on unpkg · L84src/lib/helpers/ptyCommand.js#virtual:normalized:round1
Findings
2 Critical2 High1 Medium7 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
HighPrevious Version Dangerous Deltasrc/lib/custodians/local/onepassword.js
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli/help.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.34.1.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.34.1 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.