expect-dotenv

{"modified":"2026-08-20T03:32:44Z","published":"2026-08-20T03:32:44Z","schema_version":"1.7.4","id":"MAL-2026-14316","summary":"Malicious code in expect-dotenv (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e)\nThe package's main entry runs a worker that performs an HTTPS GET to https://realase-0626.vercel.app/api/v1 and passes the response's `parser` string into vm.runInContext, then invokes the resulting function with Node's `require` — granting the remote endpoint full code-execution in the consumer's Node process. The destination URL is concealed as a hex byte array in constants.js (pluginIDs) and reassembled at runtime via String.fromCharCode, hiding the non-publisher C2 domain from casual inspection. The worker's vm context receives `require`, so the sandbox is trivially escapable and the fetched code runs with full filesystem, network, and process privileges. This behavior fires on `require('expect-dotenv')` followed by `.config()` or `.get()` — the package's primary documented API — masquerading as a dotenv-style configuration loader.\n","affected":[{"package":{"ecosystem":"npm","name":"expect-dotenv"},"versions":["7.2.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/workers/runWorker.js","sha256":"85099f550de29647787b3037a42c1834efcbc38b067cdd0677f8e9bb6c0d8079","tlsh":"11210282645d652a1971bbe895078226d14ba1737200c651b62cd7e43ff31b0b153fdc"},{"path":"lib/workers/constants.js","sha256":"d063c195bd63b4eb9c87da3f3badc4d53667aac30ca96460addccfe17ac08070","tlsh":"69e0ecde636e258f08e72f7cd280549a9bcd11906361c4cbb9e88c2de4da8548051969"},{"path":"lib/workers/plugin.worker.js","sha256":"6f515e418c9ac1f7530e376b91f57a1fe9cb66bd15775d3e19accba8d5e5922b","tlsh":"7d2198d655a820686a75bbe19f377005e316e3732004d39a7abc43a02ff24095423f9c"}],"package_integrity":[{"filename":"expect-dotenv-7.2.1.tgz","hashes":{"sha1":"682a8eb7d4af9cb67e079e46bb5362fc543545e2","sha512_sri":"sha512-UeX3EtD+wZ55AKERnfhc6c05z0OFm5+oxC+ypvw5ZSm8jDqOq3RQ98wlr9fa2b+PkC7obusvdv/LRI+wU8PWBA=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/expect-dotenv/v/7.2.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-018432","import_time":"2026-08-20T03:49:50.659658261Z","modified_time":"2026-08-20T03:32:44Z","sha256":"ffc39d28e4d33afe723182c097769f087bf528732e5468b1511bf2bff41db01e","source":"amazon-inspector","versions":["7.2.1"]}]}}