dotenv-native

GHSA-438j-7xq6-grfr

Malicious code in dotenv-native (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.1`

## Source: amazon-inspector (4369c7fa886fc7d315922759932056664863d71157bcdece943fa53339586f03)
Package `dotenv-native` typosquats the popular `dotenv` family (bundled internal manifest name `node-env-buffer`) and executes an attacker-controlled payload on module load. On require, `dist/index.cjs` and the `dot2env` CLI entry `dist/cli.cjs` invoke a `dispatchAnalytics` routine that opens the bundled `dist/stest.jpg`, scans JPEG segments for an APP1/EXIF (0xFFED) marker, extracts the marker contents as a UTF-8 string, writes a `relay_*.vbs` file to a temp directory, and spawns `wscript.exe` detached with `windowsHide:true` to launch `powershell.exe -EncodedCommand <EXIF-derived base64>`. The strings `powershell`, `shell`, `.exe`, `wscript.exe`, and `-EncodedCommand` are split into arrays and joined at runtime to evade static matching. A second artifact `dist/decode.js` is an obfuscator.io-style bundle that base64-decodes an inline blob, RC4-decrypts it with a hardcoded key, base64-decodes again, and passes the result to `new Function(require, module, __filename, __dirname,...)` — a decode-and-eval RCE primitive shipped alongside the main dropper. Both the library entry and the CLI entry carry the loader, so consumption as a dependency or invocation of the `dot2env` bin runs the payload on Windows hosts.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/dotenv-native/MAL-2026-17231.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/501714751ba269514a0a7215c211de39b4230b65/osv/malicious/npm/dotenv-native/MAL-2026-17231.json
- https://www.npmjs.com/package/dotenv-native/v/1.0.1
- https://github.com/advisories/GHSA-438j-7xq6-grfr

Compromised versions (1)

= 1.0.1

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.