registry / @dotenvx/dotenvx / 2.36.0
@dotenvx/dotenvx@2.36.0
a secure dotenv–from the creator of `dotenv`
AI Security Review
scanned 2d ago · by lpm-firewall-aiThe manifest has no install hooks, the flagged shell execution is behind an explicit update command, and the new invitation flow requires a user-requested action with supplied or interactively selected details. The flagged help-file secret was not present in the inspected source.
Static reason
One or more suspicious static signals were detected.
Trigger
The update installer runs only on an explicit update command; Armor invitations run only when explicitly invoked.
Impact
The observed network actions support package updates and user-requested team invitations; no unauthorized data collection or account action was found.
Mechanism
The package checks dotenvx.sh for a version and sends invitation details to the configured Armor hostname.
AI rationale
The manifest has no install hooks, the flagged shell execution is behind an explicit update command, and the new invitation flow requires a user-requested action with supplied or interactively selected details. The flagged help-file secret was not present in the inspected source.
Network endpoints2
dotenvx.sh/VERSION<configured Armor hostname>/api/teams/<team>/invitations
Decision evidence
public snapshotAI called this Clean at 92.0% confidence as Benign with low false-positive risk.
Evidence for AI clean decision
- The manifest declares no install lifecycle hooks and points the package entry to src/lib/main.js.
- The shell installer is executed only by the explicit update action when running the packaged binary.
- The version check fetches only the latest version from dotenvx.sh and stores the result.
- Armor invitations require a user-run command and prompt for missing team and email values.
- The invitation POST uses the configured Armor hostname and the supplied account token.
Evidence against
- The CLI can download and run an installer from dotenvx.sh when the user invokes its update action.
- The session performs a version check when selected CLI actions call notifyUpdate.
Behavioral surface
ChildProcessEnvironmentVarsFilesystemShell
HighEntropyStringsUrlStrings
Source & flagged code
7 flaggedsrc/cli/help.jsView file
87patternName = private_key_openssh
severity = critical
line = 87
Critical
Critical Secret
Package contains a critical-looking secret pattern.
src/cli/help.jsView on unpkg · L8787patternName = private_key_openssh
severity = critical
line = 87
Critical
src/lib/helpers/ptyCommand.js#virtual:normalized:round1View file
•stage = ast_semantic_analysis; reason = ast_parse_error; limitedFiles = 1
High
Semantic Analysis Limited
A bounded semantic-analysis stage reached its safety limit; remaining detectors completed, but this package requires AI review.
Findings
2 Critical1 High1 Medium8 Low
CriticalCritical Secretsrc/cli/help.js
CriticalSecret Patternsrc/cli/help.js
HighSemantic Analysis Limitedsrc/lib/helpers/ptyCommand.js#virtual:normalized:round1
MediumEnvironment Vars
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowUrl Strings
LowSuspicious Lifecycle Evidencepackage.json
LowAi Review Evidencesrc/cli/actions/update.js
LowAi Review Evidencesrc/db/session.js
LowAi Review Evidencesrc/lib/services/armorInvite.js
Affected versions and remediation
This report applies to @dotenvx/dotenvx@2.36.0.
See all versions of @dotenvx/dotenvx for other recorded verdicts.
- Review the evidence and your use of @dotenvx/dotenvx@2.36.0 before allowing it. Restrict the permissions described in this report.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.