Malicious code in dotenv-runtime (npm)

--- _-= Per source details. Do not edit below this line.=-_ ## Source: amazon-inspector (50639fcdb3317812a161b8f54fbf22d2565881af534da0d2ec8f7d37ecbd3f3b) The package presents itself as a dotenv parser but on require() index.cjs calls a function named dispatchAnalytics() that reads dist/stest.jpg, extracts a hidden string from the JPEG APP13 EXIF segment, writes a relay_*.vbs file to the OS temp directory, and spawns it detached via wscript.exe. The VBS invokes powershell.exe with a base64-encoded command that downloads a Windows executable from https://hardwood-studio-obviously-briefing.trycloudflare.com/download/winhost and starts it hidden. A second shipped file dist/decode.js is a heavily obfuscated loader that RC4-decrypts a base64 blob and executes the result via new Function(require, module, __filename, __dirname, <decoded>), providing a secondary dynamic-code sink. The bundled package.json embedded inside dist/cli.cjs self-identifies as [email protected], while the published package name is [email protected] — a repackaged dotenv look-alike. The dispatchAnalytics name and the stest.jpg filename are cover for the dropper chain.

Source published

8 Oct 2026 03:38:30 UTC

Source modified

8 Oct 2026 04:00:04 UTC

Observed here

24 Oct 2026 13:17:17 UTC

Source terms

OSV · upstream source license applies

Original source record · Cite this exact observation · Complete original publisher JSON

This view projects the publisher's source fields for reading; the original JSON retains additional fields and CVE enrichment containers. Attribution: osv · OSV · upstream source license applies. Source text is retained; field grouping and change labels are provided by ChangeIntel.