Malicious code in env-local (npm)
env-local is a malicious npm package that impersonates the popular dotenv library. It captures screenshots, logs keystrokes and mouse movements, and sends them to a remote attacker-controlled server, while also replaying remote commands on the victim's desktop.
- Disclosed
- Last updated
- Blast radius
- Any developer or CI/CD system that installed env-local, expecting the legitimate dotenv package.
- Ecosystems
- Attack vectors
- Affected entities
- env-localMalicious npm package impersonating dotenv
env-local is a typosquatting attack targeting developers who intended to install the legitimate dotenv package. The malicious package's package.json falsely references the legitimate motdotla/dotenv repository, and its main.js is a near-verbatim clone of dotenv with an injected require() call to a malicious module.\n\nUpon installation and require(), lib/tui-options.js unconditionally captures the installer's screen every 3 seconds and exfiltrates the images along with hostname, platform, and screen resolution to a hardcoded ngrok tunnel at https://shorthand-shortlist-caress.ngrok-free.dev/upload. The module also polls the same server once per second for JSON-encoded mouse coordinates and keystrokes, then replays them locally using @nut-tree-fork/nut-js, giving the attacker interactive control of the victim's desktop.\n\nOn Windows systems, the payload writes a VBS launcher to %APPDATA%\ScreenCaptureClient and registers it in HKCU\Software\Microsoft\Windows\CurrentVersion\Run as ScreenCaptureClient to achieve persistence across user logons.\n\nThe incident was identified and credited to the OpenSSF malicious-packages repository.
Indicators of compromise
- Packages
- env-local
- Domains
- shorthand-shortlist-caress.ngrok-free.dev
Remediation
- Immediately uninstall env-local from all systems and development environments
- Audit npm install logs to identify any systems that may have installed env-local
- Assume compromise of any system that installed env-local; review for unauthorized access, screen captures, and keystroke logs
- On Windows systems, check for and remove the ScreenCaptureClient VBS launcher and registry entry
- Rotate credentials and SSH keys for any accounts used on compromised systems
- Monitor network traffic for connections to https://shorthand-shortlist-caress.ngrok-free.dev and related ngrok tunnels
- Use npm audit and supply chain security tools to detect similar typosquatting attacks
Sources
- GitHub Advisory GHSA-r3pr-mmg7-gr2j · GitHub Advisory Database
Cite this entry
"Malicious code in env-local (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 10, 2026; last updated August 10, 2026. https://supplychainattack.org/incident/malicious-code-in-env-local-npm-oy4dtp
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- resolvedcritical
Malicious code in typescirpt-core (npm)
The npm package 'typescirpt-core' (a typosquat of 'typescript') contained malicious code that executed on install, downloading and executing a Windows executable and pivoting WSL environments back to the host Windows system.
npmTyposquattingCompromised package - containedcritical
Malicious code in typescrit-cli (npm)
The npm package typescrit-cli contained malicious postinstall code that downloads and executes a payload, with capability to escape WSL containers and compromise Windows hosts. The package name is a typosquat of the legitimate typescript-cli.
npmTyposquattingCompromised package - containedcritical
Malicious code in typesript-cli (npm)
The npm package 'typesript-cli' (a one-character typosquat of 'typescript') contains malicious code in its postinstall script that downloads and executes a Windows PE binary, and can cross the Linux/WSL sandbox boundary to execute payloads on the Windows host. The script also beacons to a hardcoded IP endpoint.
npmTyposquattingCompromised package - containedcritical
Malicious code in tyepescript-cli (npm)
tyepescript-cli, a typosquat of the legitimate typescript package on npm, contains malicious postinstall code that downloads and executes a Windows binary (main.exe) and beacons to an attacker-controlled server. The package uses XOR obfuscation to hide URLs, commands, and IP addresses, with special logic to target both Windows and WSL environments.
npmTyposquattingCompromised package