MAL-2026-2900

    Dashboard / Malicious Package / MAL-2026-2900

    MAL-2026-2900

    Published: 15 Apr 2026Last Modified: 23 Apr 2026

    Summary: Malicious code in dotenv-pack (npm)

    Details: dotenv-pack is a malicious npm package that when imported downloads a C2 dropper from https://api.npoint[.]io/5b357f718ab4ee355003 and executes it (similar to malware in to chai-await-test). Source: amazon-inspector (b57650f0341c4520703e30ebd6c256f564519680e225e8dabefcd48b4218dfa1) The package dotenv-pack was found to contain malicious code.

    References: https://www.indece.com/en-US/blog/7df041ba-feb1-4d87-918b-7fc2c709d805

    Affected packages

    Package

    Name: dotenv-pack

    Purl: pkg:npm/dotenv-pack

    Affected ranges

    Type: SEMVER

    Events:

    Introduced- 0
    Fixed -None

    Affected versions

    MAL-2026-2900 | CVE-DB