dotenvx

The workflow does not itself demonstrate confirmed malware, but it contains a significant supply-chain weakness: an external installer is executed directly from a live URL, and a sensitive private key is exposed to the test command and its dependency tree. Pin and verify the installer or use a trusted action/package installation method, and restrict secret exposure where possible. The checkout action reference should also be validated.