Critical Malicious Code Vulnerability in envparse2 Package
Summary
MAL-2026-16394: Malicious code in envparse2 (npm). Affects envparse2 versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The envparse2 package is an npm library designed to facilitate the parsing of environment variables from .env files. It is intended for developers to manage configuration settings in their applications easily. However, a severe vulnerability has been identified in this package, which allows for the execution of malicious code, compromising the security of any system using it.
Vulnerability Detail
The vulnerability originates from the package's main entry point and the invocation of its CLI tool, dot2env. Upon execution, the package reads a bundled JPEG file, extracts a UTF-8 string from it, and uses this string to construct a command that executes PowerShell in a hidden manner on Windows systems. This command is built using obfuscated string fragments to evade detection by static analysis tools. The presence of a JPEG file with no legitimate purpose in a dotenv-style library indicates that it serves as a container for malicious payloads. As a result, any system running this package is considered fully compromised, and all sensitive information should be treated as at risk.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall envparse2If it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary measure, you can avoid using the envparse2 package and replace it with a more secure alternative for parsing environment variables, such as dotenv. You can install dotenv using: npm install dotenv.
Conclusion
The envparse2 package contains a critical vulnerability that allows for the execution of malicious code, posing a significant risk to any system using it. Immediate action is required to remove the package and secure sensitive information. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for envparse2 →
FAQ
You should immediately remove the envparse2 package from your project and consider all secrets and keys stored on the affected system compromised.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit the Vulert playground at Vulert Scanner to check if your application is affected without needing to sign up.
The best mitigation is to remove the package entirely and replace it with a secure alternative like dotenv.
The consequences include unauthorized access to sensitive information, complete control over the affected system, and potential data breaches.
Regularly check for updates in your dependencies and use tools like Vulert to monitor for vulnerabilities in real-time.
References
Follow Vulert in Google
Get more Vulert vulnerability and dependency-security updates in Google Search and AI results.