Malicious code in env-threads (npm)
The npm package env-threads is a typosquat of the legitimate dotenv package that executes arbitrary code hidden in a steganographic JPEG payload when required. The malicious package copies dotenv's README, repository URL, homepage, description, keywords, and API surface, but ships an 82 KB obfuscated main.js that decodes and executes the hidden payload via child_process at module load time.
- Disclosed
- Last updated
- Blast radius
- Any npm consumer who installed env-threads and required it in their code; exact scope unknown but potentially widespread given the dotenv impersonation.
- Ecosystems
- Attack vectors
- Affected entities
- env-threadsMalicious npm package impersonating dotenv; executes arbitrary code from steganographically-hidden payload in embedded JPEG at require-time.
The npm package env-threads is a sophisticated typosquat attack targeting the widely-used dotenv package. The malicious package impersonates dotenv by copying its README, repository URL (git://github.com/motdotla/dotenv.git), homepage, description, keywords (dotenv, env, .env, environment, variables, config, settings), and public API surface (config, parse, populate).
However, unlike the genuine dotenv—a small, unobfuscated pure-JavaScript parser—env-threads ships an 82 KB heavily obfuscated lib/main.js file with hex-named identifiers and a string-array decoder. At module top level, the obfuscated code executes SbEjWpp(path.join(__dirname, )), which resolves to lib/stest.jpg. The SbEjWpp function reads this JPEG file using fs.readFileSync, extracts an embedded payload via steganographic decoding, and executes it through child_process.
Any consumer who installs env-threads and requires it—typically expecting dotenv-like behavior—triggers arbitrary code execution from the hidden payload at require-time. The combination of verbatim typosquatting of a top-tier npm package, heavy obfuscation absent from the original, and child_process execution of steganographically-hidden bytes is unambiguous supply-chain malware.
The incident was identified and credited to the OpenSSF.
Indicators of compromise
- Packages
- env-threads
Remediation
- Immediately remove env-threads from all package.json files and lock files.
- Audit npm install logs and dependency trees to identify all projects that may have installed env-threads.
- If env-threads was installed and required, assume arbitrary code execution occurred; conduct forensic analysis of affected systems for signs of compromise.
- Review npm audit and lock file history to determine when env-threads was introduced.
- Use npm search filters and package verification tools to avoid similar typosquats of popular packages like dotenv.
- Consider using npm package lock files and integrity verification to prevent unexpected package substitutions.
Sources
- GitHub Advisory GHSA-j3r8-fm75-pfq7 · GitHub Advisory Database
Cite this entry
"Malicious code in env-threads (npm)." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed July 27, 2026; last updated July 28, 2026. https://supplychainattack.org/incident/malicious-code-in-env-threads-npm-18zd17
Suggest a correction
Found an error or have a newer source? Corrections to factual errors take priority over new entries.
Related incidents
- containedcritical
Malicious code in exxpress-utils (npm)
The npm package exxpress-utils contained malicious code in a postinstall script that harvested npm/AWS/GitHub credentials, scanned for cryptocurrency wallet extensions, and exfiltrated sensitive files to a hardcoded C2 server. The package was a typosquat of the legitimate 'express' package.
npmCompromised packageTyposquatting - containedcritical
Malicious code in hardhat-core (npm)
The npm package hardhat-core v1.0.0 is a typosquat of the legitimate hardhat package that executes a malicious postinstall script. The script base64-decodes a URL, fetches a payload over plain HTTP from a hardcoded IP address, and pipes it directly into bash, executing arbitrary attacker-controlled code during installation.
npmTyposquattingCompromised package - containedcritical
Malicious code in prisma-callback (npm)
prisma-callback@1.0.3 is a typosquatting package impersonating the legitimate Prisma ORM. It contains a preinstall script that executes undeclared, opaque native Go binaries (prisma-amd64 or prisma-arm64) at install time without integrity verification.
npmTyposquattingCompromised package - resolvedcritical
Malicious code in prettier-lint-lenz (npm)
The npm package prettier-lint-lenz is a malicious imposter of the legitimate Prettier formatter. It executes a postinstall script that deploys clipboard-stealing malware on Windows systems, establishing persistence via a scheduled task that exfiltrates clipboard contents to a hardcoded C2 server.
npmCompromised packageTyposquatting