MAL-2026-3759

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/env-threads/MAL-2026-3759.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-3759
Published
2026-05-14T19:24:42Z
Modified
2026-05-15T07:52:59.966051Z
Summary
Malicious code in env-threads (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656)

Package env-threads impersonates the legitimate dotenv package: its README, repository URL (git://github.com/motdotla/dotenv.git), homepage, description, keywords (dotenv, env, .env, environment, variables, config, settings), and public API surface (config, parse, populate) are copied from dotenv, but the package name differs. Unlike genuine dotenv — a small unobfuscated pure-JS parser — this package ships an 82 KB heavily obfuscated lib/main.js with hex-named identifiers and a string-array decoder (xIuLO2(0x...)). At module top level, the last executable statement runs SbEjWpp(path.join(__dirname, <decoded-filename>)), which resolves to lib/stest.jpg. The SbEjWpp function calls fs.readFileSync on that file and extracts an embedded payload via steganographic decoding, then executes it through child_process. Every consumer who adds env-threads to their dependency tree and requires it — typically expecting dotenv-like behavior — triggers arbitrary code execution from a payload hidden inside a JPEG shipped in the tarball. The combination of (1) verbatim typosquat of a top-tier npm package, (2) heavy obfuscation absent from the impersonated original, and (3) child_process execution of steganographically-hidden bytes at require-time is unambiguous supply-chain malware.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-002641",
            "import_time": "2026-05-15T07:37:15.37710927Z",
            "sha256": "cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656",
            "modified_time": "2026-05-14T19:24:42Z",
            "source": "amazon-inspector",
            "versions": [
                "1.5.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / env-threads

Package

Name
env-threads
View open source insights on deps.dev
Purl
pkg:npm/env-threads

Affected ranges

Affected versions

1.*
1.5.0

Database specific

cwes 
[
    {
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code",
        "cweId": "CWE-506"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "lib/main.js",
            "tlsh": "ed83049416823864df42f530a4fa03c562af9cfbaf530f97c38d9d8664ec1e605d3a66",
            "sha256": "0ae8ea1dc80527b1ad4db76ed85796721f84f687577b6f826413e9cfd12c23a2"
        }
    ],
    "package_integrity": [
        {
            "filename": "env-threads-1.5.0.tgz",
            "hashes": {
                "sha1": "0f4d7c1676e8eeffede7edbe8fa4a769f3e08d32",
                "sha512_sri": "sha512-cd4FobAsivE7Ujxvq1uVcPlvW5AxhbVFakcqOvYWbMoWBLrTff+uPvSANPDDI/yXZ8drldk8Pw1drOML6l/Zyw=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/env-threads/MAL-2026-3759.json"