Malicious code in better-dotenv3 (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf) The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.
MAL-2026-17172
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17172
better-dotenv3
Source reference: /affected/0/package/name
- Affected versions
- 1.0.1
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "better-dotenv3",
"purl": "pkg:npm/better-dotenv3",
"ecosystem": "npm"
},
"versions": [
"1.0.1"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/better-dotenv3/MAL-2026-17172.json",
"indicators": {
"evidence_files": [
{
"path": "dist/index.cjs",
"tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79",
"sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815"
},
{
"path": "dist/cli.cjs",
"tlsh": "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9",
"sha256": "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "e7cc0815b251ae7b1a7e02268e1921e4d6866863",
"sha512_sri": "sha512-iLccaAPxav6IC4tR59iWyJpFps8gaa9GtRPmbAqfWuldK7yreR5PlS5UbQ5UkYDqesxOWe/ijzS8lWCaeXMa/g=="
},
"filename": "better-dotenv3-1.0.1.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #14784 · Revision 1
- Added to Heist Feed
- Publisher date