Credential Theft Vulnerability in dotenv-precheck Package
Summary
MAL-2026-17304: Malicious code in dotenv-precheck (npm). Affects dotenv-precheck versions 1.0.0 – 1.1.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
dotenv-precheck is an npm package designed to perform preflight checks for dotenv files. It is intended to help developers manage environment variables securely. However, a critical vulnerability has been discovered in version 1.0.0, where the package contains malicious code that compromises user credentials.
Vulnerability Detail
The vulnerability originates from a malicious implementation in dotenv-precheck version 1.0.0, which is disguised as a legitimate utility. The package includes an obfuscated postinstall script that executes automatically during npm install. This script scans the user's home directory for sensitive information, such as wallet keys and passwords, and sends this data to an attacker-controlled Telegram bot. The obfuscation techniques used make it difficult to detect the malicious behavior, posing significant risks to users' sensitive data.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall dotenv-precheckIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, users can avoid installing the dotenv-precheck package until they have confirmed that they are using a safe version. Additionally, consider using alternative packages for dotenv preflight checks that do not have known vulnerabilities.
Conclusion
The dotenv-precheck package has a serious vulnerability that allows for credential theft through malicious code. Users are strongly advised to update to the latest version to protect their sensitive information. Utilizing tools like Vulert can help monitor for such vulnerabilities in the future.
See every vulnerability recorded for dotenv-precheck →
FAQ
dotenv-precheck is an npm package intended to perform preflight checks for dotenv files, helping developers manage environment variables.
The vulnerability allows attackers to steal sensitive information from users' home directories, including passwords and wallet keys, which can lead to identity theft and financial loss.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If you have installed dotenv-precheck version 1.0.0, you should uninstall it immediately and update to version 1.1.1 or later using the command: npm install dotenv-precheck@1.1.1.
Signs of a compromised system may include unusual account activity, unexpected changes to files, or unauthorized access to sensitive information. If you suspect a compromise, take immediate action to secure your system.
