registry / dotenv-precheck / 1.1.1

dotenv-precheck@1.1.1

Runs dotenv preflight checks at install time

AI Security Review

scanned 9d ago · by lpm-firewall-ai

An automatic install hook executes obfuscated code that collects sensitive environment values, private keys, and seed phrases. It packages the collected data for an outbound HTTP upload.

Static reason

High-risk behavior combination matched malicious policy.

Trigger

npm postinstall invokes index.js during dependency installation.

Impact

Secrets from the installing user's environment and scanned files can be disclosed to an external recipient.

Mechanism

The entrypoint scans for sensitive values, stores them in a collection, serializes that collection, and submits it through fetch.

Attack narrative

Installing the package automatically runs its obfuscated entrypoint. That code identifies sensitive environment variables and wallet-related secrets, accumulates them with file context, then serializes and uploads the result through an HTTP request. The automatic execution and secret collection are unrelated to a dotenv precheck.

AI rationale

The package implements automatic secret harvesting and outbound transfer during installation. This is concrete credential and data exfiltration behavior.

Evidence

package.jsonindex.js

OSV advisory

OpenSSF/OSV

Advisory

MAL-2026-17304

Source

OpenSSF Malicious Packages via OSV

Summary

Malicious code in dotenv-precheck (npm)

dotenv-precheck@1.0.0 is a credential-stealing package disguised as a dotenv preflight utility. package.json wires index.js as a postinstall script, so it runs automatically on npm install. index.js is heavily obfuscated (obfuscator.io-style hex identifiers, a rotated string array with debugger/toString self-defense, and base64-decoded literals) to hide its runtime strings, which reconstruct at runtime to an api.telegram.org bot endpoint together with a hardcoded bot token and chat ID. On execution the script recursively walks the installer's home directory, including Desktop, Documents, and Downloads, reads text files up to 2MB, and extracts values matching wallet and secret patterns: environment-style entries whose names contain KEY, SECRET, TOKEN, PASSWORD, SEED, MNEMONIC, or WALLET; 0x-prefixed 64-hex Ethereum private keys; Base58 WIF keys; 64-integer Solana key arrays; and BIP-39 mnemonic phrases validated against the BIP-39 word list and SHA-256 checksum. Collected material is uploaded to the attacker's Telegram bot via a sendDocument multipart request to api.telegram.org. No functionality corresponding to the package's stated dotenv-preflight purpose is present. ## Source: ossf-package-analysis (48661f26d5e6181f87722c1e3c5bc997d1cc874999624c83504e0bec3029ff6c) The OpenSSF Package Analysis project identified 'dotenv-precheck' @ 1.1.1 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associated with malicious activity.

dotenv-precheck@1.1.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code