Malicious code in dotenvv-tool (npm)
The npm package dotenvv-tool is a typosquatting attack impersonating the popular dotenv package. It contains a malicious postinstall script that harvests npm credentials, environment variables, git credentials, cryptocurrency wallet data, and system information, exfiltrating them to a hardcoded C2 server.
- Disclosed
- Last updated
- Blast radius
- Any developer who installed dotenvv-tool via npm install; secrets harvested include npm publish tokens, API keys, database credentials, cloud credentials, cryptocurrency wallet data, and system information.
- Ecosystems
- Attack vectors
- Affected entities
- dotenvv-toolTyposquatting package impersonating dotenv; contains malicious postinstall script
The package dotenvv-tool on npm is a typosquatting attack designed to impersonate the legitimate dotenv package. The package's index.js is a dummy stub, with the actual malicious payload contained in a postinstall lifecycle script that executes automatically on npm install.\n\nThe postinstall script performs comprehensive credential and secret harvesting: it reads ~/.npmrc (npm publish tokens), ~/.env (API keys, database URLs, cloud credentials), and ~/.git-credentials. It also enumerates browser profile directories for Chrome, Brave, Edge, Chromium, Vivaldi, and Opera, scanning for 71 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase Wallet, Ledger, and Trezor) and extracting vault/mnemonic/privateKey/password patterns from their LevelDB .log files.\n\nAdditionally, the script scans common user directories (~/Documents, ~/Desktop, ~/Downloads) for files matching BIP-39 seed-phrase patterns, collects system hostname and user information, and exfiltrates all collected data via plaintext HTTP POST to http://149.28.127.35:8888. The operator can retarget exfiltration by setting the C2_URL environment variable without republishing the package.\n\nThe malicious code includes a self-describing header comment: "Token harvester + Crypto wallet scanner / Runs on npm install. Silent. Zero trace." This incident was identified by the OpenSSF malicious-packages project.
Indicators of compromise
- Packages
- dotenvv-tool
- IPs
- 149.28.127.35
Remediation
- Immediately uninstall dotenvv-tool from all systems and projects
- Rotate all npm publish tokens and API keys stored in ~/.npmrc
- Rotate all credentials and API keys stored in ~/.env files
- Rotate git credentials stored in ~/.git-credentials
- Change passwords for all cryptocurrency wallets and accounts, especially those using the targeted extensions (MetaMask, Phantom, Coinbase Wallet, Ledger, Trezor, etc.)
- Review browser extension activity and transaction history for unauthorized access
- Monitor for unauthorized npm package publishes using compromised tokens
- Audit git repositories for unauthorized commits
- Block the C2 IP address 149.28.127.35:8888 at network perimeter
- Use npm audit to identify any other malicious packages in dependency trees
- Consider using npm package signature verification and allowlisting for critical dependencies
Sources
- GitHub Advisory GHSA-v6vw-vv5w-p658 · GitHub Advisory Database
Cite this entry
"Malicious code in dotenvv-tool (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-dotenvv-tool-npm-1fd5h6
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in typography-stylecss (npm)
The npm package typography-stylecss is a typosquatting attack impersonating the legitimate @tailwindcss/typography plugin. It contains obfuscated malicious code that downloads and executes a platform-specific binary when the module is imported, triggered automatically during Tailwind config loading.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package