Malicious code in dotenv-runtime (npm)

{
  "id": "c5a9663190687db42fc02ded15614369a1eafd79bec57ebcbbed5fce3fb238a4",
  "url": "https://osv.dev/vulnerability/MAL-2026-17657",
  "method": "structured",
  "payload": {
    "kind": "advisory",
    "title": "Malicious code in dotenv-runtime (npm)",
    "summary": "--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b) The package presents itself as a dotenv parser but on require() index.cjs calls a function named dispatchAnalytics() that reads dist/stest.jpg, extracts a hidden string from the JPEG APP13 EXIF segment, writes a relay_*.vbs file to the OS temp directory, and spawns it detached via wscript.exe. The VBS invokes powershell.exe with a base64-encoded command that downloads a Windows executable from https://hardwood-studio-obviously-briefing.trycloudflare.com/download/winhost and starts it hidden. A second shipped file dist/decode.js is a heavily obfuscated loader that RC4-decrypts a base64 blob and executes the result via new Function(require, module, __filename, __dirname, ), providing a secondary dynamic-code sink. The bundled package.json embedded inside dist/cli.cjs self-identifies as node-env-buffer@2.2.6, while the published package name is dotenv-runtime@1.0.0 — a repackaged dotenv look-alike. The dispatchAnalytics name and the stest.jpg filename are cover for the dropper chain.",
    "evidence": "osv:MAL-2026-17657",
    "products": [
      {
        "name": {
          "value": "dotenv-runtime",
          "evidence": "/affected/0/package/name"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "1.0.0",
            "evidence": "/affected/0/versions"
          }
        ]
      }
    ],
    "severity": "unknown",
    "structured": {
      "id": "MAL-2026-17657",
      "aliases": [
        "MAL-2026-17657"
      ],
      "affected": [
        {
          "package": {
            "name": "dotenv-runtime",
            "purl": "pkg:npm/dotenv-runtime",
            "ecosystem": "npm"
          },
          "versions": [
            "1.0.0"
          ],
          "database_specific": {
            "cwes": [
              {
                "name": "Embedded Malicious Code",
                "cweId": "CWE-506",
                "description": "The product contains code that appears to be malicious in nature."
              }
            ],
            "source": "https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dotenv-runtime/MAL-2026-17657.json",
            "indicators": {
              "evidence_files": [
                {
                  "path": "dist/index.cjs",
                  "tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79",
                  "sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815"
                },
                {
                  "path": "dist/decode.js",
                  "tlsh": "96427d1d7d1670d7dfae53e32f69a78c6b78c1401956322c22b925c32d227ab504babc",
                  "sha256": "a633d418a9f2b68926ab0d49aa49cf8fac337adf38c748171bf8ff4d7c358305"
                },
                {
                  "path": "dist/cli.cjs",
                  "tlsh": "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9",
                  "sha256": "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf"
                }
              ],
              "package_integrity": [
                {
                  "hashes": {
                    "sha1": "a6482b1ee507d32f48ec8c900bee3c686ff3041e",
                    "sha512_sri": "sha512-ZhmDptgvrIKcKgsnagdRZsVTWzvOnPnYSnnaIX/KPQYRCw8e1RJVHFL9JkROUrrcTvYnrzFiCExxnPkJNZTn6g=="
                  },
                  "filename": "dotenv-runtime-1.0.0.tgz"
                }
              ]
            }
          }
        }
      ],
      "modified": "2026-10-08T04:00:04.230755317Z",
      "provider": "osv",
      "references": [
        "https://www.npmjs.com/package/dotenv-runtime/v/1.0.0"
      ],
      "provider_metadata": {
        "malicious-packages-origins": [
          {
            "id": "IN-MAL-2026-021117",
            "sha256": "50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b",
            "source": "amazon-inspector",
            "versions": [
              "1.0.0"
            ],
            "import_time": "2026-10-08T03:50:29.031075808Z",
            "modified_time": "2026-10-08T03:38:30Z"
          }
        ]
      }
    },
    "related_cves": [],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "core-osv",
  "document_id": 98427,
  "published_at": "2026-10-08T03:38:30+00:00"
}