registry / @dotenvx/dotenvx / 2.35.0
@dotenvx/dotenvx@2.35.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe package has no install hook, and the reviewed network and shell paths are associated with user-invoked features or commands. The critical-secret hint was not confirmed in the inspected help excerpt, which contains API examples with placeholders.
Static reason
One or more suspicious static signals were detected.
Trigger
Library import exposes functions; network checks, updates, and dynamic commands are reached through explicit actions or commands.
Impact
No evidence of automatic credential collection, unrelated data transmission, or unauthorized account actions was found.
Mechanism
The update check fetches a version from dotenvx.sh. The explicit packaged-binary updater invokes the vendor installer, and dynamic commands run a selected dotenvx extension from the user's project binaries.
AI rationale
The package has no install hook, and the reviewed network and shell paths are associated with user-invoked features or commands. The critical-secret hint was not confirmed in the inspected help excerpt, which contains API examples with placeholders.
Network endpoints3
dotenvx.sh/VERSIONdotenvx.sharmor.dotenvx.com
Decision evidence
public snapshotAI called this Clean at 93.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- package.json declares no install lifecycle scripts; the package entry points are its library and CLI.
- The library exports functions; the `withEvents` setup is called only when that function is invoked.
- The updater is registered as an explicit `dotenvx update` command, and its shell installer runs only in the packaged-binary case.
- The version check is called from explicit Armor, custody, native, and login actions; it fetches only the package version from dotenvx.sh.
- The dynamic command helper runs a named `dotenvx-<command>` executable after a CLI command is selected.
- The critical-secret hint is unsupported by the inspected help excerpt, which shows Armor API examples with placeholders.
Evidence against
- The package has network and filesystem capabilities for dotenv and Armor features, and the explicit update command can run `curl -sfS https://dotenvx.sh | sh`.
- The CLI can invoke extension binaries from the working directory's `node_modules/.bin` when a user selects a dynamic command.
Behavioral surface
ChildProcess
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
src/lib/helpers/ptyCommand.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical1 High1 Medium8 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/lib/main.js
LowAi Review Evidencesrc/cli/dotenvx.js
LowAi Review Evidencesrc/db/session.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.35.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.35.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.