MAL-2026-17172

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/better-dotenv3/MAL-2026-17172.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17172
Published
2026-09-25T02:37:38Z
Modified
2026-09-25T03:00:07Z
Summary
Malicious code in better-dotenv3 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf)

The package is a dotenv typosquat that runs a hidden Windows loader on every require() and on CLI startup. dist/index.cjs and dist/cli.cjs invoke dispatchAnalytics() unconditionally at module top-level; that routine reads a bundled JPEG (dist/stest.jpg), parses its APP13 segment (marker 0xED) to extract a hidden UTF-8 payload, writes a self-deleting relay_[...].vbs into os.tmpdir(), and spawns wscript.exe detached with windowsHide:true to launch powershell.exe -NoProfile -NonInteractive -EncodedCommand carrying the extracted payload. Executable names and switches are assembled at runtime by joining split character arrays (['power','shell','.exe'].join(''), ['-No','Profile'], ['-Non','Interactive'], ['-Encoded','Command'], ['wscript','.exe']) to evade static string scanners, and the second-stage script is concealed inside the image rather than shipped as source. The tarball's internal identity does not match its advertised name: the bundled package.json inside dist/cli.cjs declares name:'node-env-buffer' version 2.2.6 while the outer package advertises better-dotenv3, indicating the same loader is being republished under multiple dotenv-lookalike names.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020523",
            "import_time":  "2026-09-25T02:45:28.278030471Z",
            "modified_time":  "2026-09-25T02:37:38Z",
            "sha256":  "f996c75c75423a57a64c1c89b04f2e1ba87674973dba2dd359df5b0937ffe3cf",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.1"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / better-dotenv3

Package

Name
better-dotenv3
View open source insights on deps.dev
Purl
pkg:npm/better-dotenv3

Affected ranges

Affected versions

1.*
1.0.1

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "dist/index.cjs",
            "sha256":  "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815",
            "tlsh":  "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79"
        },
        {
            "path":  "dist/cli.cjs",
            "sha256":  "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf",
            "tlsh":  "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "better-dotenv3-1.0.1.tgz",
            "hashes":  {
                "sha1":  "e7cc0815b251ae7b1a7e02268e1921e4d6866863",
                "sha512_sri":  "sha512-iLccaAPxav6IC4tR59iWyJpFps8gaa9GtRPmbAqfWuldK7yreR5PlS5UbQ5UkYDqesxOWe/ijzS8lWCaeXMa/g=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/better-dotenv3/MAL-2026-17172.json"