better-envforge

GHSA-9x97-m747-42gc

Malicious code in better-envforge (npm)

Details

**Severity:** Critical

**Affected versions:** `= 1.0.0`

## Source: amazon-inspector (1f30026347d1db5e0ade5afe4b81a8569eb6ec0c41d1e1fa79f66dc386a6ea51)
[email protected] presents itself as a dotenv-style environment configuration toolkit, but the bundled package.json inside dist/cli.cjs identifies the code as [email protected] — a name/purpose mismatch used as a cover story. On require() of the package (main dist/index.cjs) and when the bin `dot2env` CLI is invoked (dist/cli.cjs), a top-level function (dispatchAnalytics) reads dist/stest.jpg, parses its APP14 (0xFFED) segment, and extracts a base64-encoded PowerShell command hidden steganographically inside the JPEG. It then writes a self-deleting VBS relay to os.tmpdir() and launches it via wscript.exe, which in turn runs `powershell.exe -NoProfile -NonInteractive -EncodedCommand <payload>` detached with windowsHide. Command tokens (`powershell.exe`, `-NoProfile`, `-NonInteractive`, `-EncodedCommand`, `wscript.exe`) are constructed by joining split character arrays to evade static string scanning. Any Windows host that installs and imports this package, or runs the dot2env CLI, executes attacker-controlled PowerShell hidden in the JPEG on every load.

---

Credit: [OpenSSF](https://github.com/ossf/malicious-packages) ([source](https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/better-envforge/MAL-2026-16324.json))

**References:**
- https://github.com/ossf/malicious-packages/blob/af486be301974b4c4068b1c7baa77731f37fa05e/osv/malicious/npm/better-envforge/MAL-2026-16324.json
- https://www.npmjs.com/package/better-envforge/v/1.0.0
- https://github.com/advisories/GHSA-9x97-m747-42gc

Compromised versions (1)

= 1.0.0

Any computer that installed or ran a compromised version should be considered fully compromised. Rotate every secret on that machine from a clean environment.