dotenvv-tool

{"modified":"2026-05-15T07:39:06Z","published":"2026-05-14T19:24:37Z","schema_version":"1.7.4","id":"MAL-2026-3758","summary":"Malicious code in dotenvv-tool (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (79fd33c6e511ab11f10b1dae91e2f083f486dd020bbf2dca5256eabc904f61b7)\nPackage name `dotenvv-tool` impersonates the popular `dotenv` package; index.js is an admitted dummy stub (\"The real payload is in postinstall.js\"). The `postinstall` lifecycle script runs on `npm install` and performs wholesale harvesting of installer-owned secrets: reads `~/.npmrc` (npm publish token), `~/.env` (API keys, DB URLs, cloud credentials), and `~/.git-credentials`; enumerates Chrome/Brave/Edge/Chromium/Vivaldi/Opera profile directories for 71 hardcoded crypto-wallet extension IDs (MetaMask, Phantom, Coinbase Wallet, Ledger, Trezor, etc.) and reads their LevelDB `.log` files for vault/mnemonic/privateKey/password patterns; scans `~/Documents`, `~/Desktop`, `~/Downloads` for files matching BIP-39 seed-phrase patterns; collects `os.hostname()` and `os.userInfo()`; and POSTs the bundle over plaintext HTTP to a hardcoded bare-IP endpoint at `http://149.28.127.35:8888` (postinstall.js line 7, with `process.env.C2_URL` override to let the operator retarget exfiltration without republishing). Author-written header comment self-describes the file as \"Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace.\"\n","affected":[{"package":{"ecosystem":"npm","name":"dotenvv-tool"},"versions":["2.0.0","1.0.2","1.0.4","1.0.5","1.0.3"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"},{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"domains":["http://149.28.127.35:8888"],"evidence_files":[{"path":"postinstall.js","sha256":"d8352ed570f8674227e3a1b8e812d493724370d4fc69dbacdedbbb4584d75650","tlsh":"80522998b8be012e592385eba25f11100416fc477482fca8fbdd46449f4e24d39bb3bd"}],"package_integrity":[{"filename":"dotenvv-tool-2.0.0.tgz","hashes":{"sha1":"5fdc69ec43ecbe87e29ad8060893bc2f0f5898ef","sha512_sri":"sha512-IfNaVg2BQ3Ur4T9Jt5GYR+hl4a9v7KVQTti8C+iuXxSHQRyz2AN4s9qXBGH6sMt63j3eVcmQb/s81JxD9WCtlg=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenvv-tool/v/2.0.0"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenvv-tool/v/1.0.2"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenvv-tool/v/1.0.4"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenvv-tool/v/1.0.5"},{"type":"PACKAGE","url":"https://www.npmjs.com/package/dotenvv-tool/v/1.0.3"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002805","import_time":"2026-05-15T07:37:20.096742951Z","modified_time":"2026-05-15T03:07:34Z","sha256":"1062669f2c30cac905f3866fea3c00fe6911ad978798418549d6a5e7c5547074","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-002634","import_time":"2026-05-15T07:37:15.174562598Z","modified_time":"2026-05-14T19:24:37Z","sha256":"aaf6769b158992b3a645fdae457ee3d759a0082919726b4eacc57d0832db8c07","source":"amazon-inspector","versions":["1.0.2"]},{"id":"IN-MAL-2026-002636","import_time":"2026-05-15T07:37:15.282690624Z","modified_time":"2026-05-14T19:24:38Z","sha256":"cc6d0e6e0c6fde21facbe811f1b8cfa6076b62061cc10d6f272e27855181299c","source":"amazon-inspector","versions":["1.0.4"]},{"id":"IN-MAL-2026-002638","import_time":"2026-05-15T07:37:15.34704098Z","modified_time":"2026-05-14T19:24:39Z","sha256":"4bca8ab293e09471eee82235e122a8791d1194d3433a117f5b4e2ee3075ab05d","source":"amazon-inspector","versions":["2.0.0"]},{"id":"IN-MAL-2026-002637","import_time":"2026-05-15T07:37:15.311698048Z","modified_time":"2026-05-14T19:24:38Z","sha256":"5f795e9a94b971ddc6e554688cf6e7f4d38796486582095a7b9de48ba121ca03","source":"amazon-inspector","versions":["1.0.5"]},{"id":"IN-MAL-2026-002635","import_time":"2026-05-15T07:37:15.213971092Z","modified_time":"2026-05-14T19:24:37Z","sha256":"79fd33c6e511ab11f10b1dae91e2f083f486dd020bbf2dca5256eabc904f61b7","source":"amazon-inspector","versions":["1.0.3"]}]}}