npmjs.com/package/dotenv · 18.0.9+

90/ 100

No threats observed

No threats observed: The package completed a fully covered install and entry-point run. Scanned 23 Oct 2026.

Watch how it happened Scan another

NetworkNone

No network calls

CodeNothing taken off

no code deduction

Score

90 / 100

1000

Nothing was taken off for what the code did or what running it showed.

What it did

34 events in 13.3s

Fetched0.1s

15409 bytes

Checked0.1s

0 locked dependencies, 0 malicious

Read8.8s

3 scanner finding(s)

Jev9.7s

Answered questions from the evidence

Sandbox9.7s

install completed, entry completed, 0 forged call(s)

Score10.1s

90 No threats observed

Luna's report

The run completed with full coverage and no recorded deduction. Pin the scanned version. Behaviour outside the observed install and entry windows was not verified.

We installed the package, ran its entry point in a throwaway sandbox, and scanned the reachable code. Install and entry-point execution completed with full coverage.

What it ran

Installednpm · 1 package · 2.0s

Entry pointenv -i HOME=/hom…T=1 FAKETIME_NO_CAC

NetworkNo calls

MachineDestroyed after the scan

Jev's answers

answered from the evidence

Install check

Install-time code does not use the network

Install-time code does not read credentials

Show all 5 answers

Install-time code does not run other programs or payloads

Install-time code is not obfuscated

Jev judged this code harmlesspackage.json

Docs check

The docs do not say it makes no network calls

The docs do not say it has no side effects

Show all 3 answers

What it did fits what its docs say it is for

Not verified

Behaviour outside the observed install and entry windows

Code paths not triggered by install or the entry point

Show all 4 items

Payloads gated on calendar dates past the accelerated clock window, or on hosts that need real responses

Key-shaped strings in 1 file, never seen leaving the machine

Reputation

npmWeekly npm downloads: 112057726

npmFirst npm publish: 4857 days ago

npmNo maintainer change within 30 days

npmFirst published 13 years ago

npmnpm maintainers: scottmotte, motdotla, motdotenv

npm112M weekly downloads

Shown apart from the code and behaviour findings.