Malicious Code Injection in better-dotenv3 Package
Summary
MAL-2026-17172: Malicious code in better-dotenv3 (npm). Affects better-dotenv3 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The better-dotenv3 package is a Node.js library designed to load environment variables from a .env file into process.env. It is commonly used in JavaScript applications to manage configuration settings. However, this package has been identified as a typosquat, which means it mimics a legitimate package to deceive users. The malicious version executes harmful code upon being required in an application, posing significant security risks.
Vulnerability Detail
The vulnerability stems from the better-dotenv3 package being a typosquat that executes a hidden Windows loader on every require() and during CLI startup. It invokes a function that reads a bundled JPEG file, extracts a hidden payload, and executes it using PowerShell. This behavior is concealed through obfuscation techniques, making it difficult for static analysis tools to detect. The malicious code can lead to unauthorized access and control over the affected systems.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall better-dotenv3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can avoid using the better-dotenv3 package altogether and switch to a trusted alternative like dotenv. To install dotenv, run: npm install dotenv. Make sure to update your code to use dotenv for loading environment variables.
Conclusion
The better-dotenv3 package has been identified as a malicious typosquat that executes harmful code, posing significant security risks. Users are advised to uninstall this package and switch to a trusted alternative. Regular monitoring of dependencies using tools like Vulert can help in identifying such vulnerabilities in the future.
See every vulnerability recorded for better-dotenv3 →
FAQ
A typosquat is a malicious package that mimics a legitimate package name to trick users into installing it, often containing harmful code.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
Immediately uninstall the better-dotenv3 package using npm uninstall better-dotenv3 and replace it with a trusted alternative like dotenv.
The malicious code executes by reading a hidden payload from a bundled JPEG file and running it through PowerShell, which can lead to unauthorized actions on the system.
No, there is no patch for better-dotenv3 as it is a malicious package. The best course of action is to remove it and use a legitimate alternative.
