npm / dotenv / 18.0.8

dotenv 18.0.8

Source

https://github.com/motdotla/dotenv

Tag scanned

v18.0.8

Compared with

v18.0.7 (0 signals introduced since)

Files

26 scanned, 5 skipped (binary, oversized, or unrecognised)

Signals

0 critical · 0 warn · 2 info

Scan time

3.4 s

LLM review

Reviewed by claude-haiku-5-5 (Anthropic): 2 of 2 warn and critical signals; 2 demoted to info.

Disclude version

4.1.0

Scanned (UTC)

2026-10-22 17:27

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

1. info warn → info by review dynamic-execution README.md:514:1

   [embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)

   ...
   RUN curl -fsS https://dotenvx.sh/ | sh
   ...
   RUN dotenvx prebuild

   likely benign LLM, confidence 0.80 Documentation example in a README showing a Dockerfile that installs the dotenvx CLI via curl piped to sh.

   Reasoning

   The pipe to sh from a vendor install URL is a common documented install pattern in a Dockerfile README example. It is still curl-to-shell with no checksum, so it warrants review, but the snippet shows a known tool installer, not an obfuscated dropper. The later dotenvx prebuild is a normal CLI invocation.

2. info warn → info by review encoding-base64 tests/test-parse-multiline.js:51:1

   base64-like blob (272 bytes over 5 lines, compression ratio 0.89) (raw pass, confidence 0.60)

   const multiPem = `-----BEGIN PUBLIC KEY-----
   MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnNl1tL3QjKp3DZWM0T3u
   LgGJQwu9WqyzHKZ6WIA5T+7zPjO1L8l3S8k8YzBrfH4mqWOD1GBI8Yjq2L1ac3Y/
   bTdfHN8CmQr2iDJC0C6zY8YV93oZB3x0zC/LPbRYpF8f6OqX1lZj5vo2zJZy4fI/

   likely benign LLM, confidence 0.90 Test fixture containing a PEM public key string used to exercise multiline parsing.

   Reasoning

   The blob is a PEM-formatted PUBLIC KEY block embedded as a multi-line test fixture for parsing multiline values. Base64 text in PEM format is expected, and the public key is not a secret. The raw-pass base64 heuristic fires on ordinary key material, which is a known false-positive pattern.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.1.0
git clone https://github.com/motdotla/dotenv dotenv && cd dotenv
git checkout v18.0.8
disclude scan --severity info --diff v18.0.7 .