env-threads

{"modified":"2026-05-14T19:24:42Z","published":"2026-05-14T19:24:42Z","schema_version":"1.7.4","id":"MAL-2026-3759","summary":"Malicious code in env-threads (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656)\nPackage `env-threads` impersonates the legitimate `dotenv` package: its README, repository URL (`git://github.com/motdotla/dotenv.git`), homepage, description, keywords (`dotenv`, `env`, `.env`, `environment`, `variables`, `config`, `settings`), and public API surface (`config`, `parse`, `populate`) are copied from dotenv, but the package name differs. Unlike genuine dotenv — a small unobfuscated pure-JS parser — this package ships an 82 KB heavily obfuscated `lib/main.js` with hex-named identifiers and a string-array decoder (`xIuLO2(0x...)`). At module top level, the last executable statement runs `SbEjWpp(path.join(__dirname, <decoded-filename>))`, which resolves to `lib/stest.jpg`. The `SbEjWpp` function calls `fs.readFileSync` on that file and extracts an embedded payload via steganographic decoding, then executes it through `child_process`. Every consumer who adds `env-threads` to their dependency tree and requires it — typically expecting dotenv-like behavior — triggers arbitrary code execution from a payload hidden inside a JPEG shipped in the tarball. The combination of (1) verbatim typosquat of a top-tier npm package, (2) heavy obfuscation absent from the impersonated original, and (3) child_process execution of steganographically-hidden bytes at require-time is unambiguous supply-chain malware.\n","affected":[{"package":{"ecosystem":"npm","name":"env-threads"},"versions":["1.5.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"path":"lib/main.js","sha256":"0ae8ea1dc80527b1ad4db76ed85796721f84f687577b6f826413e9cfd12c23a2","tlsh":"ed83049416823864df42f530a4fa03c562af9cfbaf530f97c38d9d8664ec1e605d3a66"}],"package_integrity":[{"filename":"env-threads-1.5.0.tgz","hashes":{"sha1":"0f4d7c1676e8eeffede7edbe8fa4a769f3e08d32","sha512_sri":"sha512-cd4FobAsivE7Ujxvq1uVcPlvW5AxhbVFakcqOvYWbMoWBLrTff+uPvSANPDDI/yXZ8drldk8Pw1drOML6l/Zyw=="}}]}}}],"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/env-threads/v/1.5.0"}],"credits":[{"name":"Amazon Inspector","type":"FINDER","contact":["actran@amazon.com"]}],"database_specific":{"malicious-packages-origins":[{"id":"IN-MAL-2026-002641","import_time":"2026-05-15T07:37:15.37710927Z","modified_time":"2026-05-14T19:24:42Z","sha256":"cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656","source":"amazon-inspector","versions":["1.5.0"]}]}}