MAL-2026-13694

    Dashboard / Malicious Package / MAL-2026-13694

    MAL-2026-13694

    Published: 10 Aug 2026Last Modified: 11 Aug 2026

    Summary: Malicious code in env-local (npm)

    Details: Source: amazon-inspector (7faefbcd9110b5e08b469d72d6541875ba4e2702c4490d1a24c37b313160f86b) env-local presents itself as a dotenv-compatible.env loader (README, keywords, and API mirror motdotla/dotenv), but lib/main.js unconditionally requires lib/tui-options.js, which activates a full-host spyware payload on module load. tui-options.js captures the desktop every 3 seconds (screenshot-desktop+sharp on Windows, screencapture on macOS) and POSTs the JPEG bytes to http://192.99.204.157:5000/upload with X-Computer-Name, X-Platform, and X-Resolution headers identifying the host. In parallel, a 1-second interval polls http://192.99.204.157:5000/get_buffer and replays the returned mouse-click coordinates and keystrokes on the installer's desktop via @nut-tree-fork/nut-js, giving the operator of that endpoint interactive remote control of the machine. On Windows, the module writes %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and registers HKCU\Software\Microsoft\Windows\CurrentVersion\Run\ScreenCaptureClient via reg.exe to invoke the launcher with wscript.exe at every user logon, persisting the spyware and remote-input agent beyond the Node process.

    References: https://www.npmjs.com/package/env-local/v/18.4.2, https://www.npmjs.com/package/env-local/v/18.4.3

    Affected packages

    Package

    Name: env-local

    Purl: pkg:npm/env-local

    Affected ranges

    Type: N/A

    Events:

    Introduced- None
    Fixed -None

    Affected versions

    18.4.2
    18.4.3
    MAL-2026-13694 | CVE-DB