registry / env-drift-check / 0.4.1

env-drift-check@0.4.1

CLI tool for .env validation, schema checking, drift detection, environment diff, git audit, and codebase scanning. Zero-code-change alternative to dotenv-safe and envalid.

Static Scan Results

scanned 12d ago · by rust-scanner

Static analysis completed at 93.0% confidence. No malicious behavior was detected; 7 low-signal pattern(s) were surfaced and cleared.

Static reason

No blocking static signals were detected.; previous stored version diff introduced dangerous source

Decision evidence

public snapshot

Behavioral surface

Source

ChildProcessDynamicRequireEnvironmentVarsFilesystem

Supply chain

UrlStrings

ManifestNo manifest risk signals triggered.

scanned 17 file(s), 55.5 KB of source, external domains: github.com, schemastore.azurewebsites.net

Source & flagged code

2 flagged

dist/config/loadConfig.jsView file

Lines 1-26javascript

1"use strict";

2var __importDefault = (this && this.__importDefault) || function (mod) {

3 return (mod && mod.__esModule) ? mod : { "default": mod };

4};

5Object.defineProperty(exports, "__esModule", { value: true });

6exports.loadConfig = loadConfig;

7const fs_1 = __importDefault(require("fs"));

8const path_1 = __importDefault(require("path"));

Medium

Dynamic Require

Package source references dynamic require/import behavior.

dist/config/loadConfig.jsView on unpkg · L6

9const DEFAULT_CONFIG = {

10 baseEnv: ".env.example",

11 rules: {}

12};

13/**

14 * Loads project configuration from envwise.config.json or envwise.config.js.

15 * JSON takes priority. Falls back to defaults if neither file exists.

16 *

17 * @returns The consolidated configuration object

18 */

19function loadConfig() {

20 const jsonPath = path_1.default.resolve("envwise.config.json");

21 const jsPath = path_1.default.resolve("envwise.config.js");

22 if (fs_1.default.existsSync(jsonPath)) {

23 const raw = fs_1.default.readFileSync(jsonPath, "utf-8");

24 let userConfig;

25 try {

26 userConfig = JSON.parse(raw);

dist/cli.jsView file

•matchType = previous_version_dangerous_delta matchedPackage = env-drift-check@0.4.0 matchedIdentity = npm:ZW52LWRyaWZ0LWNoZWNr:0.4.0 similarity = 0.933 summary = stored previous version shares package body but lacks this dangerous source file

High

Previous Version Dangerous Delta

This package version adds a dangerous source file absent from the previous stored version; route for source-aware review.

dist/cli.jsView on unpkg

Source & flagged code

2 flagged · loading source

dist/config/loadConfig.jsView file

6exports.loadConfig = loadConfig; L7: const fs_1 = __importDefault(require("fs")); L8: const path_1 = __importDefault(require("path"));

Static Scan Results

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code