dotenv 18.0.8

Source: https://github.com/motdotla/dotenv
Artifact scanned: dotenv-18.0.8.tgz (npm tarball · 15.0 KB · SHA-256 a0c5d268b6b0…)
Compared with: dotenv-18.0.7.tgz (2 signals introduced since)
Files: 6 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 5.7 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 20:36

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line dist/index.cjs:7:1 new in this release

line length 4213 characters (raw pass, confidence 0.65)
```
`).replace(/\\r/g,"\r")),n[h]=p}return n}function se(e,n){return n&&$(n.fast)?oe(e):ne(e)}function T(e){console.log(`\u2506 ${e}`)}function ie(e){console.error(`\u25C7 ${e}`)}function V(e){return e[0]==="~"?I.join(Z.homedir(),e.slice(1)):e}function ce(e={}){let n={...e};for(let t of Object.keys(n))n[t]===void 0&&delete
```
dismissed LLM, confidence 0.85 A minified CLI bundle line containing ordinary option parsing and console output code.
Reasoning
This is a long line in a minified CommonJS bundle. The visible code is ordinary CLI logic: console output with unicode escapes, path handling, and option parsing. Raw long-line findings in minified output are a known false-positive pattern, and nothing here is encoded or executed dynamically.
info ~~warn~~ → info by review long-line dist/index.cjs:8:1 new in this release

line length 3391 characters (raw pass, confidence 0.65)
```
`))}function we(e){let n=[],t=!1,o,r,s,i,l=-1;for(let h=0;h<e.length;h++){let f=e[h];if(f==="--"){l=h+1;break}if(f==="--help"||f==="-h")return{help:!0};if(f==="--quiet"||f==="-q"){o=!0;continue}if(f==="--debug"){r=!0;continue}if(f==="--override"){s=!0;continue}if(f==="--fast"){i=!0;continue}if(f==="-f"||f==="--file"||f
```
dismissed LLM, confidence 0.85 A minified CLI bundle line containing command-line flag parsing logic.
Reasoning
This is another long line in the same minified bundle. The snippet shows plain argument parsing for flags such as --quiet, --debug and --file, with no encoding, dynamic execution or concealment. The length comes from minification, not obfuscation.
info ~~warn~~ → info by review dynamic-execution README.md:514:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
...
RUN curl -fsS https://dotenvx.sh/ | sh
...
RUN dotenvx prebuild
```
likely benign LLM, confidence 0.80 A README Dockerfile example installs dotenvx by piping its install script from dotenvx.sh into sh.
Reasoning
The README's Dockerfile example runs the upstream dotenvx installer via curl piped to sh. This is a documented install step in a README, not hidden or encoded code. Piping remote scripts to a shell is a supply-chain risk worth noting, but the snippet shows no obfuscation or concealment and the pattern is common in project docs.
info identifier-low-length dist/index.cjs:1:1

799 of 1567 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o dotenv-18.0.8.tgz https://registry.npmjs.org/dotenv/-/dotenv-18.0.8.tgz
printf '%s  %s\n' a0c5d268b6b0ce3c3c39ed5c770bf08301ad0b3f01a01ffe51e682d33057b2eb dotenv-18.0.8.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf dotenv-18.0.8.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg