dotenv-preflight

{"schema_version":"1.7.4","id":"MAL-2026-17324","published":"2026-09-29T13:51:17Z","modified":"2026-10-01T05:46:21.906478354Z","summary":"Malicious code in dotenv-preflight (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0)\nThe npm package dotenv-preflight@1.0.0 presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x351140, _0x3256d4, _0x3de8a6, _0x2a9875, _0x4d88e3 on line 1, consistent with javascript-obfuscator string-array output). Legitimate dotenv/env-preflight tooling is a few dozen lines of readable JavaScript; wrapping the entire module in a string-array obfuscator has no benign purpose for a package in this category and is the standard concealment technique used to hide credential-harvesting and network exfiltration behavior from casual review. The package name closely resembles the popular dotenv ecosystem, increasing the chance of accidental installation, and the obfuscated body would execute on require() by any consumer that adds this dependency. Semantic tracing of the obfuscated code triggered the provider's malware-output safety filter, which is characteristic of operational credential-theft or exfiltration payloads rather than routine business logic.\n\n## Source: ossf-package-analysis (d8bf491882ff2e9aee1d8ab4959b8aea748223821f721550370dcf9615859d65)\nThe OpenSSF Package Analysis project identified 'dotenv-preflight' @ 1.0.0 (npm) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"dotenv-preflight","ecosystem":"npm"},"versions":["1.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"index.js","sha256":"d93524bc79491dfbb5875597bf9f2d7045c40f88ef51b741543ff17929e9f00b","tlsh":"0bf20a447bc4650227566e7f6907b4e0e96a08fa79c006ca9310fc4066f731eb7f6ab6"}],"package_integrity":[{"filename":"dotenv-preflight-1.0.0.tgz","hashes":{"sha1":"9b458d188bcd9a9870c015aab31d729c77e60f90","sha512_sri":"sha512-RX0SKkFpPJ6Phpsp1owPFDSFTbOk4Hk/Z15qMI87GZW4IndTbGLFYlHqC9hy+aDTlOo9z5CKdJAeeVXmimFI/w=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenv-preflight/v/1.0.0"}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-020800","import_time":"2026-09-30T04:46:52.160191246Z","modified_time":"2026-09-30T04:08:47Z","sha256":"f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0","source":"amazon-inspector","versions":["1.0.0"]},{"import_time":"2026-10-01T05:44:26.078139387Z","modified_time":"2026-09-29T13:51:17Z","sha256":"d8bf491882ff2e9aee1d8ab4959b8aea748223821f721550370dcf9615859d65","source":"ossf-package-analysis","versions":["1.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}