MAL-2026-6589

See a problem?
Import Source
https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/envfile-sync/MAL-2026-6589.json
JSON Data
https://api.osv.dev/v1/vulns/MAL-2026-6589
Published
2026-06-29T07:32:58Z
Modified
2026-06-29T09:16:40Z
Summary
Malicious code in envfile-sync (npm)
Details

-= Per source details. Do not edit below this line.=-

Source: amazon-inspector (533d78538183c16b774f6e5783cc1059558ca712fd129da9666361088485e055)

Package name is 'envfile-sync' but every user-facing artifact (README title, bin name, homepage, repository, bugs URL, badges, keywords, CHANGELOG) brands the package as 'envsync', a lookalike of an unrelated existing npm package. The advertised JS API is non-functional: exported sync/check/validate/init in src/index.js return hardcoded placeholders ({ ok: true, missing: [],...opts }) and never set the fields (r.added, r.example, r.inSync, r.createdExample) that bin/cli.js consumes — the documented surface is a stub. On module load, src/index.js:21-25 resolves bin/native/parser.node and calls process.dlopen(module, p), executing arbitrary native code from a 2.9MB undocumented Windows PE ('!This program cannot be run in DOS mode.'). The README explicitly denies any binary exists ('zero dependencies', 'No binary to install, nothing to audit'), and no JS export ever calls into a native parser API, so the binary's behavior is hidden from auditors and contradicts the package's documentation. The combination — typosquat branding to attract installs, stub JS to satisfy a casual reader, opaque native PE dlopen'd on import as the only real code path — is the canonical hidden-native-payload shape. Any consumer who imports envfile-sync on Windows runs the unverifiable native code with the host process's privileges.

Database specific 
{
    "malicious-packages-origins": [
        {
            "id": "IN-MAL-2026-007776",
            "import_time": "2026-06-29T09:10:16.867241594Z",
            "modified_time": "2026-06-29T07:32:58Z",
            "ranges": [
                {
                    "events": [
                        {
                            "introduced": "0"
                        }
                    ],
                    "type": "SEMVER"
                }
            ],
            "sha256": "533d78538183c16b774f6e5783cc1059558ca712fd129da9666361088485e055",
            "source": "amazon-inspector",
            "versions": [
                "1.0.0"
            ]
        }
    ]
}
References
Credits

Affected packages

npm / envfile-sync

Package

Name
envfile-sync
View open source insights on deps.dev
Purl
pkg:npm/envfile-sync

Affected ranges

Type
SEMVER
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

1.*
1.0.0

Database specific

cwes 
[
    {
        "cweId": "CWE-506",
        "description": "The product contains code that appears to be malicious in nature.",
        "name": "Embedded Malicious Code"
    }
]
indicators 
{
    "evidence_files": [
        {
            "path": "package.json",
            "sha256": "3e0ce25bb368284963c2c9bbc5080e8c8132f2515f8838e68ba5d1abc5b86b67",
            "tlsh": "6e31d863c2604c2325d0e559a8a57182a96599830fd03c4c37e9029c0f8e9bf51fe6ed"
        },
        {
            "path": "src/index.js",
            "sha256": "5b3ddf32bc5a5d1255776d28e74f400e88ee994b598b875391369c9d566d19de",
            "tlsh": "180176c736e77320c521b35da89f812d7de8d180226e4ba085950af23be06a0866796a"
        }
    ],
    "package_integrity": [
        {
            "filename": "envfile-sync-1.0.0.tgz",
            "hashes": {
                "sha1": "dbb3acde0ec853925c24f6cf59039ebccd6b89cd",
                "sha512_sri": "sha512-rAlupIj/BM/AKLEebh81DUKxZjPrQlC2z/AFzVHt/yqXE+wqnE29dFRs4njeypzJpd7u1La6Q6whDAqT7EH4FA=="
            }
        }
    ]
}
source 
"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/envfile-sync/MAL-2026-6589.json"