MAL-2026-17324

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dotenv-preflight/MAL-2026-17324.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17324
Published
2026-09-30T04:08:47Z
Modified
2026-09-30T05:00:08Z
Summary
Malicious code in dotenv-preflight (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0)

The npm package dotenv-preflight@1.0.0 presents itself as a dotenv-related preflight utility but ships a single index.js whose contents are heavily obfuscated (hex-prefixed identifiers such as _0x351140, _0x3256d4, _0x3de8a6, _0x2a9875, _0x4d88e3 on line 1, consistent with javascript-obfuscator string-array output). Legitimate dotenv/env-preflight tooling is a few dozen lines of readable JavaScript; wrapping the entire module in a string-array obfuscator has no benign purpose for a package in this category and is the standard concealment technique used to hide credential-harvesting and network exfiltration behavior from casual review. The package name closely resembles the popular dotenv ecosystem, increasing the chance of accidental installation, and the obfuscated body would execute on require() by any consumer that adds this dependency. Semantic tracing of the obfuscated code triggered the provider's malware-output safety filter, which is characteristic of operational credential-theft or exfiltration payloads rather than routine business logic.

Database specific 
{
    "malicious-packages-origins":  [
        {
            "id":  "IN-MAL-2026-020800",
            "import_time":  "2026-09-30T04:46:52.160191246Z",
            "modified_time":  "2026-09-30T04:08:47Z",
            "sha256":  "f8e18dd97225f3e61274667a66297cee2224f99b7c3915e5a5f138028f5d0dd0",
            "source":  "amazon-inspector",
            "versions":  [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / dotenv-preflight

Package

Name
dotenv-preflight
View open source insights on deps.dev
Purl
pkg:npm/dotenv-preflight

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId":  "CWE-506",
        "description":  "The product contains code that appears to be malicious in nature.",
        "name":  "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files":  [
        {
            "path":  "index.js",
            "sha256":  "d93524bc79491dfbb5875597bf9f2d7045c40f88ef51b741543ff17929e9f00b",
            "tlsh":  "0bf20a447bc4650227566e7f6907b4e0e96a08fa79c006ca9310fc4066f731eb7f6ab6"
        }
    ],
    "package_integrity":  [
        {
            "filename":  "dotenv-preflight-1.0.0.tgz",
            "hashes":  {
                "sha1":  "9b458d188bcd9a9870c015aab31d729c77e60f90",
                "sha512_sri":  "sha512-RX0SKkFpPJ6Phpsp1owPFDSFTbOk4Hk/Z15qMI87GZW4IndTbGLFYlHqC9hy+aDTlOo9z5CKdJAeeVXmimFI/w=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/dotenv-preflight/MAL-2026-17324.json"