{"id":"MAL-2026-4467","summary":"Malicious code in @weirdorg/dotenv (npm)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (dce94a089c58246a54a1e4496d323c92bb46dac654e1a1403e875292be94b198)\nPackage is a near-verbatim republication of the popular `dotenv` library (same README, API, and file layout) under the `@weirdorg/dotenv` name. The only material divergence from upstream `dotenv` is in `lib/main.js`: line 5 adds `const vconfig = require('@weirdorg/config')`, and line 253 inserts `vconfig.loadConfig();` at the top of `configDotenv()` — the function reached through the public `config()` entry point and through `require('@weirdorg/dotenv/config')`. `@weirdorg/config` is declared as a runtime dependency but is not mentioned in the README, is not part of the upstream `dotenv` API surface, and serves no documented purpose. Any installer who substitutes this package for `dotenv` (whether by typo, lockfile confusion, or scope-bait) and calls the advertised API will silently execute arbitrary code from `@weirdorg/config`, a sibling package controlled by the same publisher. This is the canonical namespace-abuse / dependency-smuggling shape: the visible package looks identical to a trusted library, while the actual payload lives in an undocumented sibling pulled in transparently through `dependencies`.\n","modified":"2026-05-26T06:02:07.127952806Z","published":"2026-05-20T07:11:29Z","database_specific":{"malicious-packages-origins":[{"import_time":"2026-05-26T05:50:43.481199213Z","modified_time":"2026-05-20T07:11:29Z","sha256":"dce94a089c58246a54a1e4496d323c92bb46dac654e1a1403e875292be94b198","source":"amazon-inspector","versions":["1.0.4"],"id":"IN-MAL-2026-003482"}]},"references":[{"type":"PACKAGE","url":"https://www.npmjs.com/package/@weirdorg/dotenv/v/1.0.4"}],"affected":[{"package":{"name":"@weirdorg/dotenv","ecosystem":"npm","purl":"pkg:npm/%40weirdorg%2Fdotenv"},"versions":["1.0.4"],"database_specific":{"cwes":[{"description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code","cweId":"CWE-506"}],"indicators":{"package_integrity":[{"hashes":{"sha1":"8691312244a0100f99265d8ba5f681cec5621703","sha512_sri":"sha512-6174oyD0eFW6+KgYw6dXsrR3APclH9yZSSSAYplp8CCZbuHJcdF5q6NPhmiLEagOIORZnlVrvek+qVwbZp/dXQ=="},"filename":"dotenv-1.0.4.tgz"}],"evidence_files":[{"tlsh":"5d5274045616b61246f3bbe2d61b5008efbb423776248180b69ca7c82f69e64c1e7fdd","path":"lib/main.js","sha256":"02c013e5ce8b27f8aa30fee569076bea1ad59d493bc98203b787feca926024fa"}]},"source":"https://github.com/ossf/malicious-packages/blob/main/osv/malicious/npm/@weirdorg/dotenv/MAL-2026-4467.json"}}],"schema_version":"1.7.5","credits":[{"name":"Amazon Inspector","contact":["actran@amazon.com"],"type":"FINDER"}]}