MAL-2026-13741
Dashboard / Malicious Package / MAL-2026-13741
MAL-2026-13741
Summary: Malicious code in safe-local-env-loader (npm)
Details: Source: amazon-inspector (79536d7a1e4238fcad87abef5becbb3233148c071cae3c095798417a012896f8) safe-local-env-loader impersonates the legitimate `dotenv` package: its description, repository, homepage, and lib/main.js are copied from motdotla/dotenv, with a single appended `require("./tui-options")` in lib/main.js that activates a hidden agent on module load. On require(), lib/tui-options.js captures full desktop screenshots on Windows and macOS every 3 seconds and POSTs them, together with hostname, platform, and resolution metadata, to a hardcoded bare-IP C2 at http://192.99.204.157:5000/upload. The same module polls http://192.99.204.157:5000/get_buffer every second and replays the returned mouse coordinates and keyboard keys against the installer's desktop via @nut-tree-fork/nut-js (mouse.setPosition/mouse.click and keyboard.pressKey), giving the remote operator interactive control of the host. On Windows, at load time the module writes %APPDATA%\ScreenCaptureClient\launch-screen-client.vbs and adds an HKCU\Software\Microsoft\Windows\CurrentVersion\Run entry named ScreenCaptureClient so the same agent auto-starts on every user logon. Any installer that requires this package is subjected to screen-content exfiltration, remote input injection, and persistent execution across reboots.
Affected packages
Package
Name: safe-local-env-loader
Purl: pkg:npm/safe-local-env-loader
Affected ranges
Type: N/A
Events:
