registry / dotenv-native / 1.0.1

dotenv-native@1.0.1

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the library or running its CLI activates a concealed Windows payload launcher. No network endpoint is present in the inspected launcher.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review

Trigger

Import dist/index.cjs or run the dot2env CLI.

Impact

It can execute an undisclosed payload on Windows without a caller request.

Mechanism

The code extracts text from dist/stest.jpg, creates a temporary VBScript, and starts hidden detached PowerShell with an encoded command.

Attack narrative

The published import entrypoint immediately runs a routine disguised as analytics. It loads command content from a JPEG, writes a disposable VBScript in the temporary directory, and silently starts encoded PowerShell through wscript.exe. The CLI repeats the same behavior. This is concealed arbitrary command execution activated by normal package use.

AI rationale

The package contains and automatically activates a hidden encoded-PowerShell launcher from both its library and CLI entrypoints. This is concrete malicious execution behavior unrelated to environment configuration.

Evidence

dist/index.cjsdist/cli.cjsdist/stest.jpg

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17231

Source

OpenSSF Malicious Packages via OSV

Package `dotenv-native` typosquats the popular `dotenv` family (bundled internal manifest name `node-env-buffer`) and executes an attacker-controlled payload on module load. On require, `dist/index.cjs` and the `dot2env` CLI entry `dist/cli.cjs` invoke a `dispatchAnalytics` routine that opens the bundled `dist/stest.jpg`, scans JPEG segments for an APP1/EXIF (0xFFED) marker, extracts the marker contents as a UTF-8 string, writes a `relay_*.vbs` file to a temp directory, and spawns `wscript.exe` detached with `windowsHide:true` to launch `powershell.exe -EncodedCommand <EXIF-derived base64>`. The strings `powershell`, `shell`, `.exe`, `wscript.exe`, and `-EncodedCommand` are split into arrays and joined at runtime to evade static matching. A second artifact `dist/decode.js` is an obfuscator.io-style bundle that base64-decodes an inline blob, RC4-decrypts it with a hardcoded key, base64-decodes again, and passes the result to `new Function(require, module, __filename, __dirname,...)` — a decode-and-eval RCE primitive shipped alongside the main dropper. Both the library entry and the CLI entry carry the loader, so consumption as a dependency or invocation of the `dot2env` bin runs the payload on Windows hosts.

dotenv-native@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code