@dotenvx/dotenvx - npm Package Compare versions

Comparing version 1.63.0 to 1.64.0

package.json

 {
-  "version": "1.63.0",
+  "version": "1.64.0",
   "name": "@dotenvx/dotenvx",
@@ -4,0 +4,0 @@ "description": "secrets for agents–from the creator of `dotenv`",

src/cli/dotenvx.js

@@ -200,3 +200,3 @@ #!/usr/bin/env node
 program.command('logout', { hidden: true })
-  .description('optional: log out of your dotenvx account')
+  .description('log out of your dotenvx account')
   .allowUnknownOption()
@@ -208,2 +208,11 @@ .action(() => {
 
+// dotenvx armor
+program.command('armor', { hidden: true })
+  .description('ARMORED KEYS ⛨')
+  .allowUnknownOption()
+  .action((args) => {
+    const rawArgs = ['ops', 'armor', ...process.argv.slice(3)]
+    executeDynamic(program, 'ops', rawArgs)
+  })
+
 // dotenvx help
@@ -210,0 +219,0 @@ program.command('help [command]')

New alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 10 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 5 instances in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Fixed alerts

Potential vulnerability

Supply chain risk

Initial human review suggests the presence of a vulnerability in this package. It is pending further analysis and confirmation.

Found 1 instance in 1 package

Shell access

Supply chain risk

This module accesses the system shell. Accessing the system shell increases the risk of executing arbitrary code.

Found 1 instance in 1 package

Uses eval

Supply chain risk

Package uses dynamic code execution (e.g., eval()), which is a dangerous practice. This can prevent the code from running in certain environments and increases the risk that the code may contain exploits or malicious behavior.

Found 1 instance in 1 package

Environment variable access

Supply chain risk

Package accesses environment variables, which may be a sign of credential stuffing or data theft.

Found 10 instances in 1 package

Filesystem access

Supply chain risk

Accesses the file system, and could potentially read sensitive data.

Found 1 instance in 1 package

AI-detected potential code anomaly

Supply chain risk

AI has identified unusual behaviors that may pose a security risk.

Found 5 instances in 1 package

URL strings

Supply chain risk

Package contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.

Found 1 instance in 1 package

Improved metrics

Total package byte prevSize

327768

0.25%

Lines of code

5343

0.15%

Number of lines in readme file

2767

0.25%

No dependency changes