better-dotenv3

{"modified":"2026-09-25T02:37:38Z","published":"2026-09-25T02:37:38Z","schema_version":"1.7.4","id":"MAL-2026-17172","summary":"Malicious code in better-dotenv3 (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf)\nThe package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.\n","affected":[{"package":{"ecosystem":"npm","name":"better-dotenv3"},"versions":["1.0.1"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"dist/index.cjs","sha256":"97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815","tlsh":"4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79"},{"path":"dist/cli.cjs","sha256":"8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf","tlsh":"d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9"}],"package_integrity":[{"filename":"better-dotenv3-1.0.1.tgz","hashes":{"sha1":"e7cc0815b251ae7b1a7e02268e1921e4d6866863","sha512_sri":"sha512-iLccaAPxav6IC4tR59iWyJpFps8gaa9GtRPmbAqfWuldK7yreR5PlS5UbQ5UkYDqesxOWe/ijzS8lWCaeXMa/g=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/better-dotenv3/v/1.0.1"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["inspector-research@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020523","import_time":"2026-09-25T02:45:28.278030471Z","modified_time":"2026-09-25T02:37:38Z","sha256":"f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf","source":"amazon-inspector","versions":["1.0.1"]}]}}