npm / dotenv / 18.0.8

dotenv 18.0.8

Source

https://github.com/motdotla/dotenv

Tag scanned

v18.0.8

Compared with

v18.0.7 (0 signals introduced since)

Files

26 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

4.2 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.0.0

Scanned (UTC)

2026-10-15 06:25

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution README.md:514:1

   [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

   ...
   RUN curl -fsS https://dotenvx.sh/ | sh
   ...
   RUN dotenvx prebuild

   likely benign LLM, confidence 0.80 README install instructions for dotenvx that pipe a remote install script into sh inside a Dockerfile example.

   Reasoning

   The flagged line is a Dockerfile example in a README that installs the dotenvx CLI via a curl-to-sh pipeline, then runs its prebuild command. The pattern is risky in general, but in project documentation it is the vendor's published install method and not a hidden dropper. The snippet shows no obfuscation or encoded payload, so this is a documented install step rather than malicious intent.

2. info warn → info by review encoding-base64 tests/test-parse-multiline.js:51:1

   base64-like blob (272 bytes over 5 lines, compression ratio 0.89) (raw pass, confidence 0.60)

   const multiPem = `-----BEGIN PUBLIC KEY-----
   MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
   LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
   bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/

   dismissed LLM, confidence 0.93 A PEM public key literal embedded as a multiline string in a JavaScript parser test.

   Reasoning

   The raw pass flagged a base64-like run, but the snippet is a PEM-formatted PUBLIC KEY block inside a template literal in a multiline-parsing test file. Base64 is the expected encoding for PEM bodies, and the high compression ratio is consistent with random key material. This is a test fixture, not an obfuscated payload.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/motdotla/dotenv dotenv && cd dotenv
git checkout v18.0.8
disclude scan --severity info --diff v18.0.7 .