registry / @dotenvx/dotenvx / 2.34.2
@dotenvx/dotenvx@2.34.2
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe reviewed entry points show no install-time hook or harmful import-time behavior. The scanner's secret finding is an SSH-key example in CLI help, while network checks, login, and update execution are connected to dotenvx features and explicit flows.
Static reason
One or more suspicious static signals were detected.
Trigger
Explicit API use or CLI commands; the downloader runs only through the explicit update command for packaged binaries.
Impact
No malicious collection, unrelated credential transfer, or unrequested account action was identified.
Mechanism
The main module exports functions without running config at import. Update checks fetch a version string, while login uses the Armor service flow.
AI rationale
The reviewed entry points show no install-time hook or harmful import-time behavior. The scanner's secret finding is an SSH-key example in CLI help, while network checks, login, and update execution are connected to dotenvx features and explicit flows.
Network endpoints2
dotenvx.sh/VERSIONarmor.dotenvx.com
Decision evidence
public snapshotAI called this Clean at 94.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json has no install, preinstall, or postinstall lifecycle scripts; the listed scripts are developer checks/releases.
- The main module exports callable dotenv functions without invoking config at import time.
- The critical-looking SSH private-key pattern is part of a documented `dotenvx set` example.
- Version checking is throttled and runs through `notifyUpdate`, called by Armor-related commands and login flows; it only fetches the latest version.
- The update command's download-and-run behavior is behind the explicit `update` command and only runs for packaged binaries.
- Login sends device public key and basic system information through the login service flow.
Evidence against
- The package has network access to its own update and Armor services.
- The CLI can launch a user-selected command with injected environment values as part of its stated purpose.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
84$ dotenvx set KEY value
$ dotenvx set KEY "value with spaces"
$ dotenvx set KEY -- "---value with a dash---"
$ dotenvx set KEY -- "-----BEGIN OPENSSH PRIVATE KEY-----
[redacted]
Low
Ai Review Evidence
The critical-looking SSH private-key pattern is part of a documented `dotenvx set` example.
src/cli/help.jsView on unpkg · L84src/lib/helpers/ptyCommand.js#virtual:normalized:round1
Findings
2 Critical1 High1 Medium8 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/lib/main.js
LowAi Review Evidencesrc/cli/help.js
LowAi Review Evidencesrc/db/session.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.34.2.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.34.2 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.