No static findings, no flagged source captured, and sandbox completed cleanly. This is the legitimate dotenv package with only expected dist files and metadata.
AI breakdown
Plain-English summary of what this package does and how it behaves.
dotenv loads environment variables from a .env file into process.env for Node.js applications. It provides both a programmatic API and a CLI binary. The package has no runtime dependencies and includes standard build/test scripts.
Capabilities
- Loads environment variables from .env files
- Exposes CLI binary
- Runs build script on prepack
Data access
- Filesystem (reads .env files)
- Environment variables
Network
- No network access observed
Widely-used utility with zero dependencies and no observed network or install-time behaviors beyond standard npm scripts. Primary consideration is ensuring .env files remain uncommitted.
Files in package (14)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/dotenv