registry / expect-dotenv / 7.2.1

expect-dotenv@7.2.1

Env config toolkit built on dotenv and env-var, with worker-threads-based decrypt/verify/validate/plugin tasks

AI Security Review

scanned 5h ago · by lpm-firewall-ai

Calling config() (also reached by get() before configuration) fetches attacker-controlled data from a remote endpoint and executes its parser. The remote parser receives Node's require in a worker thread.

Static reason

One or more suspicious static signals were detected.

Trigger

Application calls env.config() or env.get() before configuration.

Impact

Remote code execution with access to local Node modules; it can read environment/files or launch processes.

Mechanism

Remote response is VM-evaluated and invoked with require.

Attack narrative

At runtime, env.config() silently starts a plugin worker. That worker decodes and requests https://realase-0626.vercel.app/api/v1, takes parser text from the response, evaluates it in vm.runInContext, then calls the resulting code with Node's require function. The endpoint operator can therefore supply code that imports filesystem, process, or child-process-capable modules. The README's denial of network and remote evaluation contradicts the shipped implementation.

Rationale

The package contains a concrete runtime remote-code-execution chain, automatically triggered by normal configuration use, and disguises the endpoint while documentation denies the behavior.

Evidence

lib/env-var-base.jslib/workers/runWorker.jslib/workers/constants.jslib/workers/plugin.worker.jsREADME.mdpackage.json

Network endpoints1

realase-0626.vercel.app/api/v1

expect-dotenv@7.2.1

AI Security Review

Decision evidence

Source & flagged code

Source & flagged code

Findings

Source & flagged code