dotenv 18.0.7

Source: https://github.com/motdotla/dotenv
Tag scanned: v18.0.7
Compared with: v18.0.6 (0 signals introduced since)
Files: 26 scanned, 5 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 2 info
Scan time: 3.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 19:46

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review dynamic-execution README.md:514:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
...
RUN curl -fsS https://dotenvx.sh/ | sh
...
RUN dotenvx prebuild
```
likely benign LLM, confidence 0.80 README Dockerfile example that installs dotenvx via curl piped to sh, then runs dotenvx prebuild.
Reasoning
This is a Dockerfile example in a README that installs the dotenvx CLI by piping its official install script (dotenvx.sh) into sh, followed by a normal `dotenvx prebuild` step. The pipe-to-shell pattern is a real supply-chain risk in general, but here it is a documented install instruction from the tool's own domain in documentation, not obfuscated or hidden code. It is flagged by the AST pass as a shell pipeline, which matches the literal text. Nothing suggests concealment.
info ~~warn~~ → info by review encoding-base64 tests/test-parse-multiline.js:51:1

base64-like blob (272 bytes over 5 lines, compression ratio 0.89) (raw pass, confidence 0.60)
```
const multiPem = `-----BEGIN PUBLIC KEY-----
MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/
```
likely benign LLM, confidence 0.95 A PEM public key fixture embedded in a test string for multiline parsing.
Reasoning
The flagged blob is a multi-line PEM-formatted public key inside a JavaScript template literal in a test file. The base64 content is the expected body of a PEM block, which is exactly what a multiline-parsing test needs. The raw pass has a high false-positive rate for such strings, and there is no decoding, execution, or other sign of obfuscation.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/motdotla/dotenv dotenv && cd dotenv
git checkout v18.0.7
disclude scan --severity info --diff v18.0.6 .