Malicious Code Vulnerability in dotenv-node-cli Package
Summary
MAL-2026-1713: Malicious code in dotenv-node-cli (npm). Affects dotenv-node-cli versions 3.3.5. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dotenv-node-cli is a popular npm package that allows developers to load environment variables from a .env file into process.env. It is widely used in Node.js applications to manage configuration settings securely. However, this package has been identified with a malicious code vulnerability that can compromise the security of applications using it.
Vulnerability Detail
The vulnerability in dotenv-node-cli arises from the inclusion of malicious code that can execute harmful actions when the package is installed or run. This issue is particularly concerning as it can lead to unauthorized access to sensitive data, data corruption, or even complete system compromise. The malicious code was introduced in version 3.3.5 of the package, and it is crucial for developers to be aware of this risk to protect their applications.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dotenv-node-cliIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, you can avoid using dotenv-node-cli until the vulnerability is resolved. Alternatively, consider using a different package for managing environment variables, such as 'dotenv', which does not have this vulnerability.
Conclusion
The malicious code vulnerability in dotenv-node-cli poses a significant risk to applications using this package. Developers should take immediate action to update to a secure version and consider alternative solutions for managing environment variables. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for dotenv-node-cli →
FAQ
dotenv-node-cli is an npm package that helps developers load environment variables from a .env file into their Node.js applications.
The vulnerability involves malicious code that can execute harmful actions, potentially compromising the security of applications that use the package.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you are using version 3.3.5 of dotenv-node-cli, you should update to the latest version immediately to mitigate the risk.
Yes, Vulert can monitor and alert you in real-time for open-source vulnerabilities in your software using just the package-lock.json file.
