Malicious Code Injection in esm-dotenv Package
Summary
MAL-2026-17305: Malicious code in esm-dotenv (npm). Affects esm-dotenv versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The esm-dotenv package is designed as a zero-dependency dotenv parser for Node.js applications, allowing developers to manage environment variables easily. However, it has been found to contain malicious code that executes upon import, posing significant security risks to users.
Vulnerability Detail
The vulnerability originates from the package's main entry point, which invokes a function called dispatchAnalytics() during module load. This function reads a JPEG file embedded within the package, extracting a hidden PowerShell command. The command is executed through a VBS wrapper, allowing the attacker to run arbitrary code on the user's system. The malicious payload is cleverly obfuscated to evade detection by static analysis tools, making it particularly dangerous.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall esm-dotenvIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, avoid using the esm-dotenv package until a secure version is released. Consider using alternative dotenv packages that do not exhibit this vulnerability.
Conclusion
The esm-dotenv package contains a serious vulnerability that allows for the execution of malicious code upon import. Users are advised to update the package immediately or seek alternatives to mitigate risks. Regular monitoring for vulnerabilities using tools like Vulert can help maintain application security.
See every vulnerability recorded for esm-dotenv →
FAQ
esm-dotenv is a zero-dependency dotenv parser for Node.js applications, used to manage environment variables.
The vulnerability allows malicious code to execute on your system, potentially leading to data breaches or unauthorized access.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without any signup.
If an immediate update is not possible, consider removing the package and using an alternative dotenv parser until a secure version is available.
Detailed information can be found in the vulnerability report and on the package's GitHub repository.
