Critical Malicious Code Vulnerability in envforge3 Package
Summary
MAL-2026-16393: Malicious code in envforge3 (npm). Affects envforge3 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The envforge3 package is an npm module designed for various functionalities in JavaScript applications. However, it has been found to contain malicious code that executes hidden PowerShell commands on Windows systems. This vulnerability poses a significant risk to users who install and require this package, as it can lead to full system compromise.
Vulnerability Detail
The vulnerability originates from the package's main entry file, dist/index.cjs, which invokes a function called dispatchAnalytics() at the module's top level. This function reads a JPEG file and extracts hidden bytes from it, executing them as a PowerShell -EncodedCommand payload. The malicious code is cleverly disguised using obfuscation techniques, making it difficult to detect. Any user who installs this package and runs it on a Windows machine is at risk of having their system compromised, with potential exposure of sensitive information and unauthorized access to system resources.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall envforge3If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, you can prevent the execution of this malicious code by avoiding the installation of the envforge3 package altogether. If it is already installed, remove it using the command: npm uninstall envforge3.
Conclusion
The envforge3 package contains a critical vulnerability that allows malicious code execution on Windows systems. Users are advised to remove the package immediately and monitor their systems for any signs of compromise. Utilizing tools like Vulert can help in identifying and managing such vulnerabilities effectively.
See every vulnerability recorded for envforge3 →
FAQ
envforge3 is an npm package that was intended for use in JavaScript applications but has been found to contain malicious code.
The malicious code executes hidden PowerShell commands by extracting bytes from a JPEG file and running them on Windows systems.
You should immediately uninstall the envforge3 package and consider rotating any sensitive information stored on your system.
Currently, there is no patched version available for the envforge3 package. It is recommended to remove the package entirely.
You can use Vulert, which monitors and alerts in real-time for open-source vulnerabilities using just your package-lock.json file. You can also check if your application is affected by this vulnerability using the Vulert playground without any signup.
