Malicious code in dotenv-preflight (npm)
--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0) The npm package dotenv-preflight@1.0.0 presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x351140, _0x3256d4, _0x3de8a6, _0x2a9875, _0x4d88e3 on line 1, consistent with javascript-obfuscator string-array output). Legitimate dotenv/env-preflight tooling is a few dozen lines of readable JavaScript; wrapping the entire module in a string-array obfuscator has no benign purpose for a package in this category and is the standard concealment technique used to hide credential-harvesting and network exfiltration behavior from casual review. The package name closely resembles the popular dotenv ecosystem, increasing the chance of accidental installation, and the obfuscated body would execute on require() by any consumer that adds this dependency. Semantic tracing of the obfuscated code triggered the provider's malware-output safety filter, which is characteristic of operational credential-theft or exfiltration payloads rather than routine business logic. ## Source: ossf-package-analysis (d8bf491882ff2e9aee1d8ab4959b8aea748223821f721550370dcf9615859d65) The OpenSSF Package Analysis project identified 'dotenv-preflight' @ 1.0.0 (npm) as malicious. It is considered malicious because: - The package communicates with a domain associate
MAL-2026-17324
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:MAL-2026-17324
dotenv-preflight
Source reference: /affected/0/package/name
- Affected versions
- 1.0.0
Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"package": {
"name": "dotenv-preflight",
"purl": "pkg:npm/dotenv-preflight",
"ecosystem": "npm"
},
"versions": [
"1.0.0"
],
"database_specific": {
"cwes": [
{
"name": "Embedded Malicious Code",
"cweId": "CWE-506",
"description": "The product contains code that appears to be malicious in nature."
}
],
"source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dotenv-preflight/MAL-2026-17324.json",
"indicators": {
"evidence_files": [
{
"path": "index.js",
"tlsh": "0bf20a447bc4650227566e7f6907b4e0e96a08fa79c006ca9310fc4066f731eb7f6ab6",
"sha256": "d93524bc79491dfbb5875597bf9f2d7045c40f88ef51b741543ff17929e9f00b"
}
],
"package_integrity": [
{
"hashes": {
"sha1": "9b458d188bcd9a9870c015aab31d729c77e60f90",
"sha512_sri": "sha512-RX0SKkFpPJ6Phpsp1owPFDSFTbOk4Hk/Z15qMI87GZW4IndTbGLFYlHqC9hy+aDTlOo9z5CKdJAeeVXmimFI/w=="
},
"filename": "dotenv-preflight-1.0.0.tgz"
}
]
}
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #59308 · Revision 1
- Added to Heist Feed
- Publisher date