registry / Remote code execution / expect-dotenv

expect-dotenv

Env config toolkit built on dotenv and env-var, with worker-threads-based decrypt/verify/validate/plugin tasks

This report shows the evidence for expect-dotenv@7.2.1. 1 of 2 known versions is blocked or flagged. The newest version, 0.0.1-security, is allowed. See all versions.

AI Security Review

scanned 2mo ago · by lpm-firewall-ai

This is a concrete remote-code-execution chain, activated during normal dotenv configuration and concealed by an obfuscated endpoint. It is not install-time, but it is malicious runtime behavior.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls env.config() or env.get().

Impact

Remote operator can execute arbitrary Node code with the consuming process's permissions, including filesystem and environment access.

Mechanism

remote parser evaluated in VM then invoked with Node require

Attack narrative

At runtime, config() silently starts the plugin worker. The package decodes an obfuscated Vercel endpoint, fetches JSON containing parser code, and passes it to a worker. That worker evaluates the parser and calls its resulting function with the host's require function, so a server-controlled parser can load child_process, filesystem, or other Node modules and execute actions under the application process identity.

AI rationale

This is a concrete remote-code-execution chain, activated during normal dotenv configuration and concealed by an obfuscated endpoint. It is not install-time, but it is malicious runtime behavior.

Evidence

lib/env-var-base.jslib/workers/runWorker.jslib/workers/plugin.worker.jslib/workers/constants.jsREADME.md

Network endpoints1

realase-0626.vercel.app/api/v1

Decision evidence

public snapshot

AI called this Malicious at 99.0% confidence as Malware with low false-positive risk.

Evidence for block

config() automatically starts the plugin worker.
Endpoint is obfuscated as character codes: https://realase-0626.vercel.app/api/v1.
HTTPS response supplies a parser string to the worker.
Worker evaluates that parser and invokes its result with real require, enabling remote code execution.
README falsely states no network or remote evaluation.

Evidence against

package.json has no preinstall, install, or postinstall hook.
Execution requires config() or implicit config() through get(), not package installation.
Other workers implement ordinary crypto/schema operations.

Behavioral surface

Source

CryptoDynamicRequireEnvironmentVarsNetwork

Supply chainNo supply-chain packaging signals triggered.

ManifestNo manifest risk signals triggered.

scanned 7 file(s), 5.88 KB of source

Source & flagged code

5 flagged

lib/env-var-base.jsView file

16config(options = {}) { dotenv.config(options); envStore = from(process.env); runWorker("plugin");

High

Ai Review Evidence

config() automatically starts the plugin worker.

lib/env-var-base.jsView on unpkg · L16

2L3: const { from } = require("env-var"); L4: const dotenv = require("dotenv");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/env-var-base.jsView on unpkg · L2

lib/workers/plugin.worker.jsView file

1"use strict"; L2:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/workers/plugin.worker.jsView on unpkg · L1

lib/workers/runWorker.jsView file

•Remote response is passed to a worker and executed with Node capabilities. lib/workers/runWorker.js: const { Worker } = require("node:worker_threads"); const https = require("https"); const { pluginIDs } = require("./constants"); const parser = JSON.parse(data).parser; callback({ source: "array_data", array_data: c, arrayParser: parser }); const workerPath = require.resolve(`./${type}.worker.js`); worker.postMessage(arg); worker.postMessage([]); lib/workers/plugin.worker.js: const { parentPort } = require("node:worker_threads"); const vm = require("vm"); parentPort.on("message", ({ source, array_data, arrayParser }) => { const parser = vm.runInContext(`(${arrayParser})`, context); const pluginParser = parser(array_data); const pr_res = pluginParser(require); const pluginPath = parser_resul

Critical

Remote Response Code Execution

Source passes code obtained from a remote response into a dynamic execution sink.

lib/workers/runWorker.jsView on unpkg

README.mdView file

28Each of these spawns a worker thread and resolves a promise with the worker's result. No network calls are made by this package.

High

Ai Review Evidence

README falsely states no network or remote evaluation.

README.mdView on unpkg · L28

Source & flagged code

5 flagged · loading source

lib/env-var-base.jsView file

16config(options = {}) { dotenv.config(options); envStore = from(process.env); runWorker("plugin");

High

Ai Review Evidence

config() automatically starts the plugin worker.

lib/env-var-base.jsView on unpkg · L16

2L3: const { from } = require("env-var"); L4: const dotenv = require("dotenv");

Medium

Dynamic Require

Package source references dynamic require/import behavior.

lib/env-var-base.jsView on unpkg · L2

lib/workers/plugin.worker.jsView file

1"use strict"; L2:

Medium

Unsafe Vm Context

Package source executes code through a VM context API.

lib/workers/plugin.worker.jsView on unpkg · L1

Findings

1 Critical3 High5 Medium1 Low

CriticalRemote Response Code Executionlib/workers/runWorker.js

HighEval

HighAi Review Evidencelib/env-var-base.js

HighAi Review EvidenceREADME.md

MediumDynamic Requirelib/env-var-base.js

MediumUnsafe Vm Contextlib/workers/plugin.worker.js

MediumNetwork

MediumEnvironment Vars

MediumStructural Risk Force Deep Review

LowScripts Present

Affected versions and remediation

This report applies to expect-dotenv@7.2.1.

The versions list below shows the verdict for each recorded version.

Avoid installing expect-dotenv@7.2.1. Remove it from direct dependencies and check your lockfile for transitive copies.
Choose an independently verified alternative or release. This report does not establish that other versions are safe.
If this version ran, investigate the affected machine and build environment. Rotate credentials it could access and rebuild from a trusted environment.

Evidence last updated: 2026-09-14 20:30:05.708Z (UTC).

Source advisory published: 2026-08-20 03:32:44.000Z (UTC).

Think this verdict is wrong? Dispute it on GitHub or read how reports are produced.

Versions

2 known versions

0.0.1-securitylatestClean—AllowPublishedSep 14, 2026, 3:13 PM 7.2.1shownMaliciousRemote Code ExecutionBlockPublishedAug 19, 2026, 10:16 PM

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Versions

Related packages

Other remote code execution packages

Behavioral surface

Source & flagged code

Related packages

Other remote code execution packages