MAL-2026-17519

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/promises-dotenv3/MAL-2026-17519.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-17519
Published
2026-10-04T23:26:12Z
Modified
2026-10-04T23:45:20Z
Summary
Malicious code in promises-dotenv3 (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640)

promises-dotenv3@1.0.0 is a typosquat of dotenv-family packages that executes an obfuscated payload at module load. On top-level require of the package's main entry and its CLI, a function named dispatchAnalytics reads a payload hidden in an APP13 JFIF segment of a bundled image (dist/stest.jpg), writes a randomly-named VBS file (relay_*.vbs) to the OS temp directory, and spawns wscript.exe (detached) to invoke powershell.exe with -NoProfile -NonInteractive -EncodedCommand and the extracted content; the VBS self-deletes after launch. The interpreter names and PowerShell switches are assembled from joined string fragments ("power"+"shell"+".exe", "wscript"+".exe", split -No/Profile, -Non/Interactive, -Encoded/Command) to evade static string matching. The bundled package.json inside dist/cli.cjs identifies itself as node-env-buffer v2.2.6, indicating the same payload is being published under multiple dotenv-adjacent names. Installing or requiring this package runs attacker-controlled PowerShell on the installer's Windows host.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-020959",
            "import_time": "2026-10-04T23:40:45.981048735Z",
            "modified_time": "2026-10-04T23:26:12Z",
            "sha256": "146d9688d00e8fa785e2fb62976f0dad169e8055c6c92d3795536cc63527c640",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / promises-dotenv3

Package

Name
promises-dotenv3
View open source insights on deps.dev
Purl
pkg:npm/promises-dotenv3

Affected ranges

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "dist/index.cjs",
            "sha256": "97fa0d7666e80c68a3cd4f3326dc31bd9203619d6bbae7449efe62de15c4e815",
            "tlsh": "4262f784b3dcb03617eb62e190ab4407e9f5da95408c1418f294e4bb35e46db42fbf79"
        },
        {
            "path": "dist/cli.cjs",
            "sha256": "8556eeca50285aea12dfdcbc4ebcee110d916ef81ddde2e338dcf78bda2028cf",
            "tlsh": "d792d74473cdb47a17e621d070ab500beaf2cb60459c1504f2dcb07627f4a9a96ebfb9"
        }
    ],
    "package_integrity": [
        {
            "filename": "promises-dotenv3-1.0.0.tgz",
            "hashes": {
                "sha1": "7e1685fab16c44df641af78e4b581044136e7fea",
                "sha512_sri": "sha512-E5zUfEgoiDMxH5YzEFaTyMp1FkYh5DBcILzGtFMPvhSTyc8wWq0eYVd3EVFGKQRCNhefz4IoGpkr7vxyvkjfJA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/promises-dotenv3/MAL-2026-17519.json"