registry / envparse3 / 1.0.1

envparse3@1.0.1

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 16d ago · by lpm-firewall-ai

Importing the package or running its CLI extracts a hidden command from dist/stest.jpg and executes it through a temporary VBScript and hidden PowerShell. The dropper is bundled into the published main, module, config, and bin entrypoints.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Any require or import of the main or config entry, or invocation of the dot2env bin, runs the loader at load time.

Impact

Arbitrary code from the bundled image runs on the host with the privileges of the Node process, without a user command to enable it.

Mechanism

Code scans the JPEG for marker 0xED, writes a randomly named relay script under the OS temp directory, and spawns a detached hidden wscript process that runs powershell -EncodedCommand and then deletes the script.

Attack narrative

envparse3 presents itself as a dotenv toolkit, but its published CommonJS bundle runs a disguised loader on import and on CLI startup. The loader reads dist/stest.jpg, pulls text from a JPEG comment-style segment, and writes a temp VBScript. That script hides a PowerShell process, feeds it the extracted encoded command, and deletes itself. Config and ESM wrappers load the same bundle, so ordinary application startup executes the payload.

AI rationale

Load-time execution in the main and CLI bundles extracts a concealed command from a bundled JPEG and runs it through hidden PowerShell, which is a concrete remote-code dropper. The readable decode.js copy documents the same chain, and there is no user gate.

Evidence

dist/index.cjsdist/cli.cjsdist/decode.jsdist/config.cjsdist/index.mjs

On require('envparse3'), the package's main entrypoint invokes a top-level function (dispatchAnalytics) that reads a bundled image dist/stest.jpg, extracts a hidden payload from the JPEG APP13 (0xED) segment, writes a self-deleting.vbs file to the OS temp directory, and spawns wscript.exe which launches powershell.exe -NoProfile -NonInteractive -EncodedCommand with the base64 payload harvested from the image. The same loader is reachable via the bin CLI dot2env (dist/cli.cjs), which also re-requires the main module and re-triggers the loader. Evasion markers are present: the executable name and switches ('powershell.exe', '-NoProfile', '-NonInteractive', '-EncodedCommand') are constructed by joining split string fragments, the payload is concealed inside a JPEG segment rather than shipped as code, and cover-story identifiers such as dispatchAnalytics, telemetryFs, scanMetricFrame, and analyticsEnvelope frame the loader as telemetry. The bundle in dist/cli.cjs self-identifies with an internal package name 'node-env-buffer' that differs from the published name 'envparse3', consistent with a repackaged/renamed clone of a legitimate env parser repurposed as a Windows dropper. ## Source: ghsa-malware (cf6625a76e25d09cfc8b39996f8ecacccd8d5c7cff8d412547ba534b2fd29d17) Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outside entity, there is no guarantee that removing the package will remove all malicious software resulting from installing it.

envparse3@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code