MAL-2026-3759

Dashboard / Malicious Package / MAL-2026-3759

MAL-2026-3759

Summary: Malicious code in env-threads (npm)

Details: Source: amazon-inspector (cfb511e0bf06367ec0341939aa68ee55859344c6ca6cb8d9f55f7e62cdcc8656) Package `env-threads` impersonates the legitimate `dotenv` package: its README, repository URL (`git://github.com/motdotla/dotenv.git`), homepage, description, keywords (`dotenv`, `env`, `.env`, `environment`, `variables`, `config`, `settings`), and public API surface (`config`, `parse`, `populate`) are copied from dotenv, but the package name differs. Unlike genuine dotenv — a small unobfuscated pure-JS parser — this package ships an 82 KB heavily obfuscated `lib/main.js` with hex-named identifiers and a string-array decoder (`xIuLO2(0x...)`). At module top level, the last executable statement runs `SbEjWpp(path.join(__dirname, <decoded-filename>))`, which resolves to `lib/stest.jpg`. The `SbEjWpp` function calls `fs.readFileSync` on that file and extracts an embedded payload via steganographic decoding, then executes it through `child_process`. Every consumer who adds `env-threads` to their dependency tree and requires it — typically expecting dotenv-like behavior — triggers arbitrary code execution from a payload hidden inside a JPEG shipped in the tarball. The combination of (1) verbatim typosquat of a top-tier npm package, (2) heavy obfuscation absent from the impersonated original, and (3) child_process execution of steganographically-hidden bytes at require-time is unambiguous supply-chain malware.

References: https://www.npmjs.com/package/env-threads/v/1.5.0