Malicious code in esm-dotenv (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (55c5c67c48596e011158554f8b5ea57d65a8a8dc3b5f4120d3c9c4d1cf961da2) The package advertises itself as a zero-dependency dotenv parser but its main entry `dist/index.cjs` and CLI bin `dist/cli.cjs` both invoke `dispatchAnalytics()` at top-level module load. That function reads `dist/stest.jpg`, walks the JPEG marker structure to extract the APP13 (0xED) segment as UTF-8, treats those bytes as a base64-encoded PowerShell command, writes a `relay_*.vbs` wrapper into `os.tmpdir()`, and spawns `wscript.exe` detached with `windowsHide:true` to launch `powershell.exe -NoProfile -NonInteractive -EncodedCommand `. The `powershell.exe` and `-EncodedCommand` strings are assembled from split-array joins (`["power","shell",".exe"].join("")`) to evade static keyword scanners, and the payload bytes are hidden inside a JPEG segment rather than in JavaScript source. A second shipped loader, `dist/decode.js`, is heavily obfuscated (string-array + numeric-id lookup) and reconstructs code via RC4-style XOR of a base64 blob (~8 KB decoded) before executing it through `new Function('require','module','__filename','__dirname', )`, providing an additional dynamic-code sink. The dropper fires the moment any Windows host imports the package.
MAL-2026-17305
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17305
esm-dotenv
Source reference: /affected/0/package/name
- Affected versions
- 1.0.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "esm-dotenv",
"purl": "pkg:npm/esm-dotenv",
"ecosystem": "npm"
},
"versions": [
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/esm-dotenv/MAL-2026-17305.json",
"indicators": {
"evidence_files": [
{
"path": "dist/index.cjs",
"tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79",
"sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815"
},
{
"path": "dist/stest.jpg",
"tlsh": "8454232d75839b3497acc0ec32c275958f3c29b3f05dc61b8336b6744ea22179e99da1",
"sha256": "68602ff5f85537f922b186ed58fb25316168e9c5d5d37a6bfa7c5f14de82ac07"
},
{
"path": "dist/decode.js",
"tlsh": "9a427c4cbd1a305bcb7ed3d336453395a1ac8a802b2e145cb27605e36fb3d8a95532ac",
"sha256": "6c38f6aea6e7951d53b92d7f947ece0d69a7114d1f4abf8d7196a6a21439f1a6"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "e0413be76a0f39c3c0c6bf483bdd100e8da652ae",
"sha512_sri": "sha512-f3lZW/iPHV6Ggsh/Lt1qFqrtRyihg7SpK2hu9DnEd73m21OOcU3usLdR+pZLX6FSuqUWvp8YonlmHgc5TAkbKg=="
},
"filename": "esm-dotenv-1.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #33425 · Revision 1
- Added to Heist Feed
- Publisher date