{"id":"MAL-2026-17657","revision":"5c0cfb97680347bd9750ea4c56311036","records":[{"revision":"5c0cfb97680347bd9750ea4c56311036","observedAt":"2026-10-24T13:17:17.793+00:00","statement":{"source":"osv","id":"MAL-2026-17657","aliases":[],"title":"Malicious code in dotenv-runtime (npm)","description":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b)\nThe package presents itself as a dotenv parser but on require() index.cjs calls a function named dispatchAnalytics() that reads dist/stest.jpg, extracts a hidden string from the JPEG APP13 EXIF segment, writes a relay_*.vbs file to the OS temp directory, and spawns it detached via wscript.exe. The VBS invokes powershell.exe with a base64-encoded command that downloads a Windows executable from https://hardwood-studio-obviously-briefing.trycloudflare.com/download/winhost and starts it hidden. A second shipped file dist/decode.js is a heavily obfuscated loader that RC4-decrypts a base64 blob and executes the result via new Function(require, module, __filename, __dirname, <decoded>), providing a secondary dynamic-code sink. The bundled package.json embedded inside dist/cli.cjs self-identifies as node-env-buffer@2.2.6, while the published package name is dotenv-runtime@1.0.0 — a repackaged dotenv look-alike. The dispatchAnalytics name and the stest.jpg filename are cover for the dropper chain.\n","state":0,"publishedAt":"2026-10-08T03:38:30+00:00","modifiedAt":"2026-10-08T04:00:04.2307553+00:00","affected":[{"ecosystem":"npm","name":"dotenv-runtime","ranges":[],"versions":["1.0.0"],"rawVersionEvidence":null}],"metrics":[],"references":["https://www.npmjs.com/package/dotenv-runtime/v/1.0.0"],"sourceUrl":"https://osv.dev/vulnerability/MAL-2026-17657","license":"OSV · upstream source license applies","key":"osv:MAL-2026-17657","identifiers":["MAL-2026-17657"]},"retained":false,"historicalAffected":[]}],"coverage":[]}