registry / esm-dotenv / 1.0.1

esm-dotenv@1.0.1

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 9d ago · by lpm-firewall-ai

Importing the CommonJS entry or running the CLI launches a hidden PowerShell payload embedded in a JPEG. The payload downloads and executes a remote Windows executable.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Requiring dist/index.cjs or invoking the dot2env CLI.

Impact

A remote executable can be downloaded and run on Windows without a package feature requiring that behavior.

Mechanism

The code extracts an encoded command from dist/stest.jpg, writes a temporary VBS launcher, and starts it detached through wscript.

Attack narrative

The package disguises a PowerShell downloader as image metadata. Its CommonJS import path and CLI invoke the loader automatically, which creates a self-deleting VBS file and launches an encoded PowerShell command hidden and detached. The embedded command downloads winhost from a trycloudflare endpoint into the local application-data temporary area and starts it.

AI rationale

This is an active concealed remote-code-execution chain, not environment configuration functionality. The import-time and CLI triggers make the payload directly reachable.

Evidence

package.jsondist/index.cjsdist/cli.cjsdist/stest.jpg

Network endpoints1

duo-strengthening-essex-ian.trycloudflare.com/download/winhost

OSV advisory

The package advertises itself as a zero-dependency dotenv parser but its main entry `dist/index.cjs` and CLI bin `dist/cli.cjs` both invoke `dispatchAnalytics()` at top-level module load. That function reads `dist/stest.jpg`, walks the JPEG marker structure to extract the APP13 (0xED) segment as UTF-8, treats those bytes as a base64-encoded PowerShell command, writes a `relay_*.vbs` wrapper into `os.tmpdir()`, and spawns `wscript.exe` detached with `windowsHide:true` to launch `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>`. The `powershell.exe` and `-EncodedCommand` strings are assembled from split-array joins (`["power","shell",".exe"].join("")`) to evade static keyword scanners, and the payload bytes are hidden inside a JPEG segment rather than in JavaScript source. A second shipped loader, `dist/decode.js`, is heavily obfuscated (string-array + numeric-id lookup) and reconstructs code via RC4-style XOR of a base64 blob (~8 KB decoded) before executing it through `new Function('require','module','__filename','__dirname', <decoded>)`, providing an additional dynamic-code sink. The dropper fires the moment any Windows host imports the package.

esm-dotenv@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code