promises-dotenv3

GHSA-3rx7-3cx7-x3hv

Malicious code in promises-dotenv3 (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640)
[email protected] is a typosquat of dotenv-family packages that executes an obfuscated payload at module load. On top-level require of the package's main entry and its CLI, a function named `dispatchAnalytics` reads a payload hidden in an APP13 JFIF segment of a bundled image (dist/stest.jpg), writes a randomly-named VBS file (relay_*.vbs) to the OS temp directory, and spawns wscript.exe (detached) to invoke powershell.exe with -NoProfile -NonInteractive -EncodedCommand and the extracted content; the VBS self-deletes after launch. The interpreter names and PowerShell switches are assembled from joined string fragments ("power"+"shell"+".exe", "wscript"+".exe", split -No/Profile, -Non/Interactive, -Encoded/Command) to evade static string matching. The bundled package.json inside dist/cli.cjs identifies itself as `node-env-buffer` v2.2.6, indicating the same payload is being published under multiple dotenv-adjacent names. Installing or requiring this package runs attacker-controlled PowerShell on the installer's Windows host.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/promises-dotenv3/MAL-2026-17519.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/ae1ef40954ea15dd560720d58f647c9880afc699/osv/malicious/npm/promises-dotenv3/MAL-2026-17519.json
- https://www.npmjs.com/package/promises-dotenv3/v/1.0.0
- https://github.com/advisories/GHSA-3rx7-3cx7-x3hv

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.