Critical Malicious Code Vulnerability in native-env Package
Summary
MAL-2026-17237: Malicious code in native-env (npm). Affects native-env versions 1.0.1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The native-env package, version 1.0.1, is marketed as a zero-dependency dotenv toolkit designed for managing environment variables in Node.js applications. However, it has been found to contain malicious code that executes upon requiring the module or running its command-line interface. This vulnerability poses a significant risk to users, as it can lead to unauthorized code execution on their systems.
Vulnerability Detail
The vulnerability originates from the malicious code embedded within the native-env package. When the module is required or the CLI is executed, it invokes a function that reads a hidden payload from a JPEG file included in the package. This payload is executed using Windows scripting tools, allowing an attacker to run arbitrary commands on the user's machine. The malicious behavior is designed to evade detection by static analysis tools, making it particularly dangerous.
How To Fix
This package is malicious. Remove it and rotate any credentials it could have accessed.
npm uninstall native-envIf it arrived as a transitive dependency, remove the package that pulled it in, then reinstall.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a temporary workaround, users can avoid using the native-env package and switch to a trusted alternative for managing environment variables, such as dotenv or config. Additionally, ensure that any dependencies are regularly audited for vulnerabilities.
Conclusion
The native-env package contains a critical vulnerability that allows for the execution of malicious code. Users are strongly advised to update or remove the package to protect their systems. Regularly auditing dependencies and using tools like Vulert can help maintain security in your applications.
See every vulnerability recorded for native-env →
FAQ
The native-env package is a Node.js toolkit for managing environment variables, but it has been compromised with malicious code.
The malicious code executes when the native-env module is required or its CLI is run, triggering a function that runs hidden commands.
You should update the package to a patched version or remove it from your project to mitigate the risk.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check your application without needing to sign up.
The vulnerability can lead to unauthorized code execution, data breaches, and compromise of the user's system.
