registry / dotenv-runtime / 1.0.0

dotenv-runtime@1.0.0

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 2d ago · by lpm-firewall-ai

Public entrypoints automatically activate a concealed Windows command launcher. This is active payload execution unrelated to environment configuration.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Importing the library or loading the CLI on a system with Windows Script Host and PowerShell available.

Impact

Executes the embedded PowerShell command with the consumer's privileges; its further effects were not established.

Mechanism

Read an encoded command from dist/stest.jpg, write a self-deleting temporary VBScript, and launch it through a detached, hidden Windows Script Host process.

Attack narrative

Importing the library activates a launcher disguised as analytics. It extracts a command from JPEG metadata, constructs PowerShell's encoded-command arguments, and writes a temporary VBScript that deletes itself and starts PowerShell invisibly. The CLI includes and activates the same mechanism. Automatic concealed command execution establishes malicious behavior even though the embedded command's ultimate effects remain unknown.

AI rationale

Inspected source proves automatic, concealed execution of a bundled encoded PowerShell command through a self-deleting script. This concrete behavior supports blocking independently of scanner similarity claims.

Evidence

package.jsondist/index.cjsdist/cli.cjsdist/stest.jpg

OSV advisory

The package presents itself as a dotenv parser but on require() index.cjs calls a function named dispatchAnalytics() that reads dist/stest.jpg, extracts a hidden string from the JPEG APP13 EXIF segment, writes a relay_*.vbs file to the OS temp directory, and spawns it detached via wscript.exe. The VBS invokes powershell.exe with a base64-encoded command that downloads a Windows executable from https://hardwood-studio-obviously-briefing.trycloudflare.com/download/winhost and starts it hidden. A second shipped file dist/decode.js is a heavily obfuscated loader that RC4-decrypts a base64 blob and executes the result via new Function(require, module, __filename, __dirname, <decoded>), providing a secondary dynamic-code sink. The bundled package.json embedded inside dist/cli.cjs self-identifies as node-env-buffer@2.2.6, while the published package name is dotenv-runtime@1.0.0 — a repackaged dotenv look-alike. The dispatchAnalytics name and the stest.jpg filename are cover for the dropper chain.

dotenv-runtime@1.0.0

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code