dotenv@8.6.0 is the well-known legitimate package for loading .env files. No static findings, only standard source files present, and sandbox install succeeded with no suspicious behavior.
AI breakdown
Plain-English summary of what this package does and how it behaves.
dotenv loads environment variables from a .env file into the process environment. Its main entry point is lib/main.js and it includes supporting modules for CLI and env options. The package has no runtime dependencies and provides standard lint/test/release scripts.
Capabilities
- Loads environment variables from .env files
- Includes CLI options and env options modules
- Runs lint, flow, dtslint and tap tests via npm scripts
Data access
- Filesystem (reads .env files)
- Environment variables
Network
- No network access observed
Widely used utility for local configuration with no dependencies or network behavior observed in the manifest; standard development scripts only.
Files in package (26)
How ShadowCanopy checks npm packages
ShadowCanopy blocks every dependency by default and only lets through what it can verify — against live malicious-package advisories, an AI behavior scan, and a byte-for-byte hash check. It protects installs across npm, PyPI, crates.io, pkg.go.dev, RubyGems, Maven Central, NuGet, Packagist, Hex, pub.dev, Swift Package Manager.
This report reflects ShadowCanopy's threat intelligence at page load and is informational, not a warranty. Canonical URL: https://shadowcanopy.dev/packages/npm/dotenv