dotenv 18.0.9

Source: https://github.com/motdotla/dotenv
Artifact scanned: dotenv-18.0.9.tgz (npm tarball · 15.0 KB · SHA-256 d3a797ba2dea…)
Compared with: dotenv-18.0.8.tgz (1 signals introduced since)
Files: 6 scanned, 1 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 4 info
Scan time: 5.5 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.3.0
Scanned (UTC): 2026-10-23 05:42

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~warn~~ → info by review long-line dist/index.cjs:8:1 new in this release

line length 3385 characters (raw pass, confidence 0.65)
```
`))}function we(e){let n=[],t=!1,o,r,s,i,l=-1;for(let h=0;h<e.length;h++){let f=e[h];if(f==="--"){l=h+1;break}if(f==="--help"||f==="-h")return{help:!0};if(f==="--quiet"||f==="-q"){o=!0;continue}if(f==="--debug"){r=!0;continue}if(f==="--override"){s=!0;continue}if(f==="--fast"){i=!0;continue}if(f==="-f"||f==="--file"||f
```
likely benign LLM, confidence 0.88 A minified argument-parsing function from a CLI bundle.
Reasoning
The raw pass flagged a 3385-character line in the same minified bundle. The snippet is a plain command-line argument parser handling flags such as --help, --quiet, --debug and --file. The length comes from minification, not from encoding or obfuscation, and no dangerous sink appears in the snippet.
info ~~warn~~ → info by review dynamic-execution README.md:514:1

[embedded bash] pipeline feeds into `sh` — piped data is executed as shell code (ast pass, confidence 0.80)
```
...
RUN curl -fsS https://dotenvx.sh/ | sh
...
RUN dotenvx prebuild
```
likely benign LLM, confidence 0.80 A README Dockerfile example installs dotenvx by piping its official install script to sh.
Reasoning
The snippet is a Dockerfile example in a README that pipes the dotenvx.sh installer into sh, followed by a normal `dotenvx prebuild` step. Piping a vendor install script to a shell is a risky habit, but it is a documented, legitimate install method for a known tool and shows no obfuscation or hidden payload. The ast pass flags the pipeline by design, so this is a supply-chain hygiene concern rather than evidence of malicious intent.
info identifier-low-length dist/index.cjs:1:1

799 of 1566 non-conventional identifiers are single-character (51%) (token pass, confidence 0.50)
info ~~warn~~ → info by review long-line dist/index.cjs:7:1

line length 4213 characters (raw pass, confidence 0.65)
```
`).replace(/\\r/g,"\r")),n[h]=p}return n}function se(e,n){return n&&$(n.fast)?oe(e):ne(e)}function T(e){console.log(`\u2506 ${e}`)}function ie(e){console.error(`\u25C7 ${e}`)}function V(e){return e[0]==="~"?I.join(Z.homedir(),e.slice(1)):e}function ce(e={}){let n={...e};for(let t of Object.keys(n))n[t]===void 0&&delete
```
likely benign LLM, confidence 0.85 A minified CLI bundle line containing ordinary console logging, home-path expansion, and option helpers.
Reasoning
The raw pass flagged a 4213-character line in a bundled CommonJS file. The snippet shows ordinary minified CLI code: console logging with unicode escapes, path handling with os.homedir, and object cloning. Minified distribution bundles routinely produce long lines, and nothing here decodes or executes hidden content. Raw findings have a higher false-positive rate.

Reproduce This Scan

Run disclude locally to verify. These commands scan the published file; the "new in this release" marks come from comparing it with the previous release's file, which they don't repeat. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.3.0
curl -fsSL -o dotenv-18.0.9.tgz https://registry.npmjs.org/dotenv/-/dotenv-18.0.9.tgz
printf '%s  %s\n' d3a797ba2dea4970b314e65156703965e83cc5f926ffec6648b9540f9ad5715a dotenv-18.0.9.tgz | shasum -a 256 -c -
mkdir pkg && tar -xzf dotenv-18.0.9.tgz -C pkg --strip-components 1
disclude scan --untrusted --severity info pkg