registry / native-env / 1.0.1

native-env@1.0.1

A fast, validated, zero-dependency environment configuration toolkit for Node.js

AI Security Review

scanned 10d ago · by lpm-firewall-ai

Importing the main module or starting the CLI activates hidden Windows command execution. The package extracts an encoded payload from a bundled image and launches it detached.

Static reason

No blocking static signals were detected.; source matched previously finalized malicious package; routed for review; source fingerprint signature matched known malicious package; routed for review

Trigger

Import dist/index.cjs, load the config entrypoint, or run the dot2env CLI.

Impact

A package import or CLI invocation can execute an opaque attacker-controlled payload on Windows.

Mechanism

The code reads dist/stest.jpg, extracts JPEG metadata, writes a temporary VBScript, and starts PowerShell with an encoded command through hidden detached wscript.

Attack narrative

The declared main entrypoint immediately invokes a routine disguised as analytics. It extracts text from a bundled JPEG, constructs a PowerShell encoded-command invocation, writes a randomly named temporary VBScript that deletes itself, and starts it hidden and detached. The CLI duplicates and automatically invokes the same routine. This is covert arbitrary payload execution during ordinary package use.

AI rationale

Hidden extraction and detached execution of an opaque PowerShell payload is concrete malware behavior, not environment configuration functionality. Automatic activation from both runtime entrypoints makes the risk immediate.

Evidence

dist/index.cjsdist/cli.cjsdist/stest.jpg

OSV advisory

OpenSSF/OSV

native-env@1.0.1 presents itself as a zero-dependency dotenv toolkit but executes attacker-chosen code on Windows the moment the module is required or the bin is run. Both dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() at module top level. dispatchAnalytics() reads dist/stest.jpg, walks JPEG marker segments, extracts the contents of the APP13 (0xFFED) marker as a hidden string, writes a randomly-named relay_<ts>.vbs into the OS temp directory, and spawns wscript.exe detached (windowsHide:true) to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand with the JPEG-hidden payload; the VBS self-deletes. The bundled dist/stest.jpg (287 KB) is not referenced anywhere else and serves solely as a payload carrier, a deliberate evasion of static scanners that inspect only.js files. dist/decode.js is a separate heavily-obfuscated loader using an obfuscator.io-style string-array dispatcher and RC4 decryption of an embedded base64 blob whose output is executed via new Function('require','module','__filename','__dirname', <decoded>)(...). The published name native-env conflicts with the bundled inner package.json which identifies the artifact as node-env-buffer 2.2.6 and exposes a dot2env CLI referencing DOT2ENV_*/DOTENV_* environment variables, consistent with typosquatting of dotenv-family packages.

native-env@1.0.1

AI Security Review

OSV advisory

Decision evidence

Source & flagged code

Source & flagged code

Findings

Affected versions and remediation

Source & flagged code